CVE-2026-104035CWE-772

CVE-2026-104035

Medium · published October 6, 2026

CVSS v3.1
5.5
EPSS
0%
Percentile
0.6
In the wild
Unconfirmed
What it is

A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive.

The record
Technical detail
CVSS v3.1
5.5 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00095 · 0.6th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-10-06T05:16Z
References (2)
https://access.redhat.com/security/cve/CVE-2026-104035 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2479107 · [email protected]
EPSS history
Timeline
  • 06 OCT 00:12Z
    Sssd: sssd: denial of service via memory exhaustion in kcm responder
    cvelistv5
  • 06 OCT 00:12Z
    Sssd: sssd: denial of service via memory exhaustion in kcm responder
    cvelistv5