CVE-2026-90463

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.

This update for sssd fixes the following issues:

• CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).
• CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read (bsc#1273922).
• CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds reads (bsc#1273925).
• CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory disclosure (bsc#1273924).
• CVE-2026-90462: Fail-open in LDAP ppolicy access check allows continued authorization (bsc#1282584).
• CVE-2026-90463: out-of-bounds read in the NSS service request parsers (bsc#1280360).
• CVE-2026-90994: out-of-bounds read in PAM v1 parser (bsc#1280361).
• CVE-2026-90995: NULL pointer dereference in PAM responder (bsc#1280362).
• CVE-2026-90996: zero-length request body underflow in the NSS responder (bsc#1280363).
• CVE-2026-92821: access control bypass due to premature LDAP access rule evaluation (bsc#1284326).
• CVE-2026-104029: denial of service due to out-of-bounds read in autofs responder (bsc#1284314).
• CVE-2026-104031: denial of service via memory exhaustion in autofs responder (bsc#1284316).
• CVE-2026-104033: access control bypass due to improper LDAP shadow expiration check (bsc#1284318).
• CVE-2026-104036: denial of service due to out-of-bounds write in NFS idmap plugin (bsc#1284321).
• CVE-2026-104037: denial of service due to packet length underflow in autofs responder (bsc#1284322).
• CVE-2026-104038: denial of service via missing SID extension in certificate mapping (bsc#1284323).
• CVE-2026-104039: denial of service due to stale connection state reuse in PAM GSSAPI responder (bsc#1284324).
• CVE-2026-104043: Denial of Service via undersized packet parsing in NSS responder (bsc#1284266).
• CVE-2026-104045: denial of service via race condition in autofs responder (bsc#1284470).