CVE-2026-104045CWE-772

CVE-2026-104045

Medium · published October 7, 2026

CVSS v3.1
4.7
EPSS
0%
Percentile
0.8
In the wild
Unconfirmed
What it is

A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00100 · 0.8th percentile
Weakness
CWE-772 · Missing Release of Resource after Effective Lifetime
Published
2026-10-07T01:17Z
Affected products (6)
ProductVersionsFixed in
fedoraproject/sssdall versions—
redhat/openshift_container_platformall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
redhat/enterprise_linuxall versions—
References (3)
https://access.redhat.com/security/cve/CVE-2026-104045 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2478663 · [email protected]https://bugzilla.redhat.com/show_bug.cgi?id=2478663 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 08 OCT 03:27Z
    EPSS moved — → 0%
    epss
  • 06 OCT 20:37Z
    Sssd: sssd: denial of service via race condition in autofs responder
    cvelistv5