CVE-2026-90994

Sssd: sssd: denial of service via malformed pam v1 requests

Published Sep 14, 2026 CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Description

A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.

Analysis

Technical impact

A flaw was discovered in the PAM responder's protocol v1 parser in sssd, allowing a local user with access to the PAM responder's UNIX socket to send an empty or truncated PAM request. This malformed input triggers an out‑of‑bounds read, potentially causing the PAM responder to terminate or restart, which results in a local denial of service.

Affected Systems

The vulnerability affects Red Hat Enterprise Linux 6 through 10 and Red Hat OpenShift Container Platform 4. The affected component is the sssd PAM responder; no specific patch versions are listed, so any release within the stated families remains potentially vulnerable unless a patch has been applied.

Risk and Exploitability

With a CVSS score of 4.0, the vulnerability is considered moderate; the EPSS score is unavailable, and it is not listed in the CISA KEV catalog. The attack requires local access to the PAM responder socket (typically /var/lib/sss/pipes/pam), so only users or processes that can read or write to that socket can exploit it. Because it only causes a service crash, the impact is limited to denial of service, not data compromise.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor	Product	Default status	Versions
Red Hat	Red Hat Enterprise Linux 10	affected	—
Red Hat	Red Hat Enterprise Linux 6	unknown	—
Red Hat	Red Hat Enterprise Linux 7	affected	—
Red Hat	Red Hat Enterprise Linux 8	affected	—
Red Hat	Red Hat Enterprise Linux 9	affected	—
Red Hat	Red Hat OpenShift Container Platform 4	affected	—
Red Hat	Red Hat OpenShift Container Platform 4	affected	—
Red Hat	Red Hat OpenShift Container Platform 5	affected	—

No data.

Vendor Product Versions

Red Hat

Enterprise Linux

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Enterprise Linux

Version	Status	Scheme	Platform
`—`	affected	—	—

Redhat

Openshift Container Platform

Version	Status	Scheme	Platform
`—`	affected	—	—

Sssd

Version	Status	Scheme	Platform
`—`	affected	—	—

Remediation

Vendor Workaround

There's no available mitigation for this issue.

OpenCVE Recommended Actions

Restrict the file permissions of the PAM responder UNIX socket (usually /var/lib/sss/pipes/pam) to trusted users, such as setting ownership to root and mode 0600.
If possible, rename or relocate the PAM responder socket to a location protected by SELinux or AppArmor, enforcing strict access controls.
Apply any Red Hat security updates for sssd that contain a fix, and monitor official advisories for later patches.

Generated by OpenCVE AI on September 15, 2026 at 13:05 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.171% probability within 30 days)

Exploitation none

Automatable no

Technical Impact partial

References

Link	Providers
https://access.redhat.com/security/cve/CVE-2026-90994
https://bugzilla.redhat.com/show_bug.cgi?id=2479455
https://nvd.nist.gov/vuln/detail/CVE-2026-90994
https://www.cve.org/CVERecord?id=CVE-2026-90994

History

Nov 10, 2026 11:15 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Red Hat Red Hat enterprise Linux Redhat openshift Container Platform Sssd Sssd sssd
Vendors & Products		Red Hat Red Hat enterprise Linux Redhat openshift Container Platform Sssd Sssd sssd

Nov 6, 2026 2:00 AM First appearance in the feed. Affected versions updated. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Redhat rhel Els
CPEs	cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9	cpe:/a:redhat:enterprise_linux:10 cpe:/a:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:9 cpe:/a:redhat:openshift:5 cpe:/o:redhat:rhel_els:6 cpe:/o:redhat:rhel_els:7
Vendors & Products		Redhat rhel Els

Sep 15, 2026 12:15 PM Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
References		https://nvd.nist.gov/vuln/detail/CVE-2026-90994 https://www.cve.org/CVERecord?id=CVE-2026-90994
Metrics	threat_severity `None`	threat_severity `Moderate`

Sep 14, 2026 9:00 PM Description updated. Title updated. First appearance in the feed. Weaknesses updated. Affected versions updated. Affected vendors updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
Title		Sssd: sssd: denial of service via malformed pam v1 requests
First Time appeared		Redhat Redhat enterprise Linux Redhat openshift
Weaknesses		CWE-125
CPEs		cpe:/a:redhat:openshift:4 cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:enterprise_linux:8 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux Redhat openshift
References		https://access.redhat.com/security/cve/CVE-2026-90994 https://bugzilla.redhat.com/show_bug.cgi?id=2479455
Metrics		cvssV3_1 `{'score': 4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`