CVE-2026-104030— Sssd: sssd: denial of service via out-of-bounds read during passkey parsing
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 SSSD（System Security Services Daemon）中发现了一个漏洞。该漏洞允许本地用户通过提交一个特别构造的、缺少空字符终止符（null terminators）的 passkey 认证令牌，从而导致拒绝服务（DoS）。认证服务会读取超过所提供的内存缓冲区边界，导致进程崩溃，进而中断认证服务。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of ServiceAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unknown |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-104030
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sssd: sssd: denial of service via out-of-bounds read during passkey parsing
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存读
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-104030
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-104030
请登录查看更多情报信息。
Other References for CVE-2026-104030 (2)
Same Patch Batch · Red Hat · 2026-10-05 · 12 CVEs total
| CVE-2026-101919 | 8.8 HIGH | Hypershift: hypershift: unsanitized kubeconfig passthrough from tenant namespace to contro |
| CVE-2026-71299 | 6.5 MEDIUM | Maestro: maestro: rest api write endpoints registered without authentication middleware |
| CVE-2026-105306 | 6.5 MEDIUM | Keycloak-services: keycloak-services: token introspection audience bypass via dynamic clie |
| CVE-2026-71298 | 6.4 MEDIUM | Maestro: sql identifier injection via properties.* search filter and orderby field |
| CVE-2026-105302 | 5.7 MEDIUM | Keycloak-services: keycloak-services: user session note mapper exposes upstream idp access |
| CVE-2026-71297 | 5.4 MEDIUM | Maestro: maestro: grpc broker has no auth interceptor and client mtls is optional |
| CVE-2026-102295 | 5.4 MEDIUM | Quay: quay: dom-based cross-site scripting via oauth local callback format=json parameter |
| CVE-2026-102576 | 4.2 MEDIUM | Quay: quay: dom-based cross-site scripting via unvalidated redirect_url on signin page |
| CVE-2026-105301 | 4.0 MEDIUM | Keycloak-services: keycloak-services: blind ssrf via x.509 authenticator fetching attacker |
| CVE-2026-104029 | 3.3 LOW | Sssd: sssd: denial of service via out-of-bounds read in autofs responder |
| CVE-2026-105326 | 2.5 LOW | Cups: cups: argument injection in mailto notifier via notify-recipient-uri |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-104029
Sssd: sssd: denial of service via out-of-bounds read in auto -
CVE-2026-105326
Cups: cups: argument injection in mailto notifier via notify -
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi
Same vendor: Red Hat
-
CVE-2026-71297
Maestro: maestro: grpc broker has no auth interceptor and cl -
CVE-2026-104029
Sssd: sssd: denial of service via out-of-bounds read in auto -
CVE-2026-71299
Maestro: maestro: rest api write endpoints registered withou -
CVE-2026-71298
Maestro: sql identifier injection via properties.* search fi -
CVE-2026-105326
Cups: cups: argument injection in mailto notifier via notify
Same weakness: CWE-125
-
CVE-2026-104029
Sssd: sssd: denial of service via out-of-bounds read in auto -
CVE-2026-59782
JavaScript preprocessing memory disclosure -
CVE-2026-105251
vgmstream VAG File psx_decoder.c ps_find_padding out-of-boun -
CVE-2026-20534
高通调制解调器越界读取漏洞 -
CVE-2026-105164
NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bou
V. Comments for CVE-2026-104030
No comments yet