CVE-2026-68744— Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply
Quick assessment
Affected
Red Hat Red Hat Enterprise Linux 10
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Red Hat SSSD是美国Red Hat公司的一款身份认证与权限管理软件。 Red Hat SSSD存在资源管理错误漏洞，该漏洞源于NSS responder的sss_nss_protocol_fill_initgr()函数为所有组条目预分配回复空间，但在跳过组时不收缩数据包，导致未初始化的堆字节被发送至客户端，本地攻击者可能利用此漏洞泄露缓存的目录数据和sssd_nss进程的堆布局信息。
Possible ATT&CK Techniques 1 AI
T1005 · Data from Local SystemAffected Version Matrix 7
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 6 | any |
unaffected |
| Red Hat | Red Hat Enterprise Linux 7 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 8 | any |
affected |
| Red Hat | Red Hat Enterprise Linux 9 | any |
affected |
| Red Hat | Red Hat OpenShift Container Platform 4 | any |
affected |
any |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-68744
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply
Source: CVE Program / CVE List V5
Vulnerability Description
A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
对未经初始化资源的使用
Source: CVE Program / CVE List V5
Vulnerability Title
Red Hat SSSD 资源管理错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Red Hat SSSD是美国Red Hat公司的一款身份认证与权限管理软件。 Red Hat SSSD存在资源管理错误漏洞，该漏洞源于NSS responder的sss_nss_protocol_fill_initgr()函数为所有组条目预分配回复空间，但在跳过组时不收缩数据包，导致未初始化的堆字节被发送至客户端，本地攻击者可能利用此漏洞泄露缓存的目录数据和sssd_nss进程的堆布局信息。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Red Hat | Red Hat Enterprise Linux 10 | - |
cpe:/o:redhat:enterprise_linux:10
|
|
| Red Hat | Red Hat Enterprise Linux 6 | - |
cpe:/o:redhat:enterprise_linux:6
|
|
| Red Hat | Red Hat Enterprise Linux 7 | - |
cpe:/o:redhat:enterprise_linux:7
|
|
| Red Hat | Red Hat Enterprise Linux 8 | - |
cpe:/o:redhat:enterprise_linux:8
|
|
| Red Hat | Red Hat Enterprise Linux 9 | - |
cpe:/o:redhat:enterprise_linux:9
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
| Red Hat | Red Hat OpenShift Container Platform 4 | - |
cpe:/a:redhat:openshift:4
|
|
II. Public POCs for CVE-2026-68744
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-68744
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-68744 (2)
-
🔗 https://access.redhat.com/security/cve/CVE-2026-68744 Read full article vdb-entry x_refsource_REDHAT
-
🔗 2509761 – (CVE-2026-68744) CVE-2026-68744 sssd: sssd: NSS responder uninitialized heap disclosure in initgroups reply Read full article issue-tracking x_refsource_REDHAT
Same Patch Batch · Red Hat · 2026-08-04 · 6 CVEs total
| CVE-2026-42169 | 7.3 HIGH | Gimp: gimp apng loader heap-buffer-overflow when fctl width exceeds ihdr width (file-png.c |
| CVE-2026-68743 | 5.5 MEDIUM | Sssd: sssd: pam responder out-of-bounds read via unchecked auth_token_length in protocol v |
| CVE-2026-18103 | 4.9 MEDIUM | Dhcp-server: dhcp-server: persistent denial of service due to buffer overflow via omapi |
| CVE-2026-17614 | 4.4 MEDIUM | Wildfly-core: path traversal on wildfly domain controller |
| CVE-2026-18569 | 3.7 LOW | Keycloak-services: keycloak-services: oidc backchannel logout accepts unsigned forged logo |
IV. Related Vulnerabilities
Same product: Red Hat Enterprise Linux 10
-
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained -
CVE-2026-103242
Rpm: heap-based buffer overflow write in hex2binv() via a mi -
CVE-2026-102560
Libsoup: libsoup: heap buffer overflow during outgoing perme -
CVE-2026-102559
Libsoup: libsoup: heap buffer overflow during websocket clie
Same vendor: Red Hat
-
CVE-2026-103754
Ansible-runner: ansible-runner: path traversal and symlink e -
CVE-2026-96577
Oc-mirror__release-4.21: embedded local cache registry liste -
CVE-2026-83589
Oauth-proxy: open redirect via /\ and /\t bypass in post-log -
CVE-2026-103641
Gegl: gegl04: gegl: out-of-bounds read in the radiance hdr u -
CVE-2026-103399
Libsoup: soupserver: http/1 request smuggling via undrained
V. Comments for CVE-2026-68744
No comments yet