CVE-2026-90996
published 2026-09-14CVE-2026-90996: A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS)…
PriorityP422medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.13%
2.2th percentile
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | sssd | — | — |
| fedoraproject | sssd | — | — |
| openshift | ose-rhel-coreos-8 | — | — |
| openshift | ose-rhel-coreos-9 | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | openshift_container_platform | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests
vendor_redhat·2026-09-14·CVSS 4.0
CVE-2026-90996 [MEDIUM] CWE-191 sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests
sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.
Statement: This flaw is rated M
GHSA
A flaw was found in sssd.
ghsa_unreviewed·2026-09-14
CVE-2026-90996 [MEDIUM] CWE-191 A flaw was found in sssd.
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-90996 sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests [fedora-all]
bugzilla·2026-09-23·CVSS 4.0
CVE-2026-90996 [MEDIUM] CVE-2026-90996 sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests [fedora-all]
CVE-2026-90996 sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Local DoS Risk in NSS Responder Due to Zero-Length Request Body
Underflow: crafted header-only NSS requests can force `blen == 0` in
parsers that inspect `body[blen - 1]`, and if the final header byte is
`'\0'` the path can continue into `sss_utf8_check(body, SIZE_MAX)`,
creating a local denial-of-service condition in the NSS responder.
Requirements to exploit: Ability to run code as a local unprivileged user
o
Bugzilla
CVE-2026-90996 sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests
bugzilla·2026-05-18·CVSS 4.0
CVE-2026-90996 [MEDIUM] CVE-2026-90996 sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests
CVE-2026-90996 sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests
AI_ONLY_REPORT
package: sssd-2.12.0-1.el10
Summary: Local DoS Risk in NSS Responder Due to Zero-Length Request Body
Underflow: crafted header-only NSS requests can force `blen == 0` in
parsers that inspect `body[blen - 1]`, and if the final header byte is
`'\0'` the path can continue into `sss_utf8_check(body, SIZE_MAX)`,
creating a local denial-of-service condition in the NSS responder.
Requirements to exploit: Ability to run code as a local unprivileged user
on a system where the NSS responder is enabled and reachable through its
UNIX socket, and to send a crafted 16-byte request to an affected parser
such as `SSS_NSS_GETPWNAM`.
Component affected: `sssd-2.12.0-1.el10`; NSS responder request p
2026-09-14
Published