CVE-2026-104038CWE-476

CVE-2026-104038

Medium · published October 6, 2026

CVSS v3.1
5.9
EPSS
0%
Percentile
12.1
In the wild
Unconfirmed
What it is

A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to verify the presence of the extension before processing it, causing the process to crash during authentication or lookup operations.

The record
Technical detail
CVSS v3.1
5.9 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00222 · 12.1th percentile
Weakness
CWE-476 · NULL Pointer Dereference
Published
2026-10-06T05:16Z
References (3)
https://access.redhat.com/security/cve/CVE-2026-104038 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2478980 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2478980 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 07 OCT 03:39Z
    EPSS moved — → 0%
    epss
  • 06 OCT 00:12Z
    Sssd: sssd: denial of service via missing sid extension in certificate mapping
    cvelistv5