Description
A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).
Published: 2026-10-06
Score: 5.5 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service
Action: Apply Patch
AI Analysis

Impact

A flaw in SSSD causes memory allocated during processing of autofs requests to be retained until the client connection is closed. A local attacker who can maintain an open connection and repeatedly issue valid autofs requests can exhaust system memory, causing the service to become unresponsive. This issue is classified as an unreleased resource flaw (CWE‑772).

Affected Systems

Red Hat Enterprise Linux 6, 7, 8, 9, 10 and Red Hat OpenShift Container Platform 4 are affected when the autofs responder service is enabled. The vulnerability is present in the SSSD component of these systems.

Risk and Exploitability

The CVSS base score of 5.5 indicates moderate severity. The EPSS score is not available and the vulnerability has not been listed in the CISA KEV catalog. The attack vector is local; a privileged or local user must be able to open a connection to the autofs responder. Successful exploitation leads to memory exhaustion and a denial of service, impacting availability for the affected service and potentially other services sharing the same host resources.

Generated by OpenCVE AI on October 6, 2026 at 01:25 UTC.

Remediation

Vendor Workaround

Disable the SSSD autofs responder if automount maps are not served through SSSD in your environment. To stop and disable the socket-activated autofs responder, run: # systemctl stop sssd-autofs.socket sssd-autofs.service # systemctl mask sssd-autofs.socket If the autofs responder is explicitly configured in /etc/sssd/sssd.conf, remove autofs from the services line and restart SSSD. If the responder must remain enabled, restrict access to the autofs responder socket to trusted local clients only. Closing long-lived client connections or restarting the responder reclaims the retained memory, but this is operational containment rather than a complete fix. Note that disabling the autofs responder prevents the resolution and mounting of automount maps managed via SSSD, and stopping or restarting SSSD services will briefly interrupt active identity lookups and automount operations.

OpenCVE Recommended Actions

  • Apply the latest Red Hat security updates that include the fixed SSSD autofs responder patch via the standard RHEL and OpenShift update channels.
  • If an update cannot be applied immediately, disable or restrict the autofs responder component so that only trusted local users can access it, thereby preventing persistent connections that could consume memory.
  • Configure SSSD or the underlying operating system to limit concurrent autofs requests or enforce memory quotas, following Red Hat guidance on resource management for services that allocate per‑connection memory.

Generated by OpenCVE AI on October 6, 2026 at 01:25 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 28 Oct 2026 14:45:00 +0000

Type Values Removed Values Added
First Time appeared Fedoraproject
Fedoraproject sssd
CPEs cpe:2.3:a:fedoraproject:sssd:2.12.0:*:*:*:*:*:*:*
cpe:2.3:a:redhat:openshift_container_platform:4.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Fedoraproject
Fedoraproject sssd

Tue, 06 Oct 2026 21:00:00 +0000

Type Values Removed Values Added
First Time appeared Red Hat
Red Hat enterprise Linux
Redhat openshift Container Platform
Sssd
Sssd sssd
Vendors & Products Red Hat
Red Hat enterprise Linux
Redhat openshift Container Platform
Sssd
Sssd sssd

Tue, 06 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 06 Oct 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Moderate

Tue, 06 Oct 2026 00:45:00 +0000

Type Values Removed Values Added
Description A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).
Title Sssd: sssd: denial of service via memory exhaustion in autofs responder
First Time appeared Redhat
Redhat enterprise Linux
Redhat openshift
Weaknesses CWE-772
CPEs cpe:/a:redhat:openshift:4
cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
Redhat openshift
References
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Fedoraproject Sssd
Red Hat Enterprise Linux
Redhat Enterprise Linux Openshift Openshift Container Platform
Sssd Sssd
cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2026-10-16T10:57:25.185Z

Reserved: 2026-10-01T17:20:25.333Z

Link: CVE-2026-104031

cve-icon Vulnrichment

Updated: 2026-10-06T13:01:42.538Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-06T01:16:33.843

Modified: 2026-10-28T14:27:44.513

Link: CVE-2026-104031

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-10-05T21:45:46Z

Links: CVE-2026-104031 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-10-06T20:45:05Z

Weaknesses
  • CWE-772

    Missing Release of Resource after Effective Lifetime