CVE-2026-90463

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

View on CVE.org

Published Sep 14, 2026 CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

Analysis

Technical impact

A local input‑validation flaw exists in the sssd NSS responder. A malicious user can send crafted service lookup requests to the responder’s UNIX socket, causing a buffer underrun read that may crash the process. The vulnerability does not provide privilege escalation or reliable data disclosure, but it does allow an attacker to repeatedly terminate the NSS responder, impairing name‑service resolution for local processes.

Affected Systems

The flaw affects all Red Hat Enterprise Linux releases 6 through 9 and the Red Hat OpenShift Container Platform 4 distribution. Systems running these operating environments with the sssd NSS responder active are susceptible.

Risk and Exploitability

The CVSS score of 4.0 indicates a moderate severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector is local; unprivileged users can normally reach the UNIX socket, so an attacker must have local access. Because the effect is a denial of service rather than data exposure, the overall risk is confined to service disruption.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor	Product	Default status	Versions
Red Hat	Red Hat Enterprise Linux 10	affected	—
Red Hat	Red Hat Enterprise Linux 6	unknown	—
Red Hat	Red Hat Enterprise Linux 7	affected	—
Red Hat	Red Hat Enterprise Linux 8	affected	—
Red Hat	Red Hat Enterprise Linux 9	affected	—
Red Hat	Red Hat OpenShift Container Platform 4	affected	—
Red Hat	Red Hat OpenShift Container Platform 4	affected	—
Red Hat	Red Hat OpenShift Container Platform 5	affected	—

No data.

No data available yet.

Remediation

Vendor Workaround

There's no appropriated mitigation for this issue.

OpenCVE Recommended Actions

Restrict local access to the SSSD NSS responder UNIX socket (`/var/lib/sss/pipes/nss`) by setting strict file permissions or enforcing UID restrictions, which reduces the attack surface but does not fix the parser bug.
After changing the socket permissions, restart the SSSD service so the new rules take effect.
Continuously monitor system logs for NSS responder crashes, ensuring the socket remains protected, and check for any vendor‑issued patch; when available, apply the official upgrade to fully remove the vulnerability.

Generated by OpenCVE AI on September 15, 2026 at 13:23 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.150% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-90463
https://bugzilla.redhat.com/show_bug.cgi?id=2479268
https://nvd.nist.gov/vuln/detail/CVE-2026-90463
https://www.cve.org/CVERecord?id=CVE-2026-90463

History

Nov 6, 2026 8:00 PM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat rhel Els
CPEs	cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9	cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/a:redhat:openshift:5 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7
Vendors & Products		Redhat rhel Els

Sep 15, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-90463 https://www.cve.org/CVERecord?id=CVE-2026-90463
Metrics	threat_severity `None`	threat_severity `Low`

Sep 14, 2026 9:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.
Title		Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)
First Time appeared		Redhat Redhat enterprise Linux Redhat openshift
Weaknesses		CWE-125
CPEs		cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux Redhat openshift
References		https://access.redhat.com/security/cve/CVE-2026-90463 https://bugzilla.redhat.com/show_bug.cgi?id=2479268
Metrics		cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`