CVE-2026-90994
Sssd: sssd: denial of service via malformed pam v1 requests
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Sssd: sssd: denial of service via malformed pam v1 requests
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
- Record
CVE-2026-90994- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-06
EUVDEUVD-2026-77588
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
- Record
EUVD-2026-77588- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-m9pj-qp75-2h63
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules)...
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
- Record
GHSA-m9pj-qp75-2h63- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-02
NVD
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
- Record
CVE-2026-90994- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-125
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-90994
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
- Record
DEBIAN-CVE-2026-90994- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-07
OSVOESA-2026-4284
sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.
Security Fix(es):
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.(CVE-2026-90994)
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the pam_app_services configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.(CVE-2026-90995)
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.(CVE-2026-90996)
- Record
OESA-2026-4284- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Show 5 moreShow less
OSVOESA-2026-4285
sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.
Security Fix(es):
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.(CVE-2026-90994)
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the pam_app_services configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.(CVE-2026-90995)
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.(CVE-2026-90996)
- Record
OESA-2026-4285- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-4286
sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.
Security Fix(es):
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.(CVE-2026-90994)
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the pam_app_services configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.(CVE-2026-90995)
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.(CVE-2026-90996)
- Record
OESA-2026-4286- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2026-4287
sssd security update
Provides a set of daemons to manage access to remote directories and authentication mechanisms. It provides an NSS and PAM interface toward the system and a pluggable back end system to connect to multiple different account sources. It is also the basis to provide client auditing and policy services for projects like FreeIPA.
Security Fix(es):
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.(CVE-2026-90994)
A flaw was found in SSSD (System Security Services Daemon). A local attacker with privileges to connect to the PAM (Pluggable Authentication Modules) responder socket can send a specially crafted protocol request. If the pam_app_services configuration is enabled and the service item is omitted from the request, a NULL pointer dereference can occur. This vulnerability leads to a denial of service, causing the PAM responder to crash and disrupt authentication services.(CVE-2026-90995)
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.(CVE-2026-90996)
- Record
OESA-2026-4287- CVSS 3.1
- 5.5 Medium
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-90994
A flaw was found in sssd, specifically within the PAM (Pluggable Authentication Modules) responder's protocol v1 parser, pam_parse_in_data(). A local client with access to the PAM responder's UNIX socket can exploit this by negotiating protocol v1 and sending an empty or truncated PAM request body. This can trigger an out-of-bounds read, potentially causing the PAM responder to terminate or restart, leading to a local denial of service.
- Record
UBUNTU-CVE-2026-90994- CVSS 3.1
- 4.0 Medium
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
OSVSUSE-SU-2026:5079-1 No score
Security update for sssd
This update for sssd fixes the following issues:
- CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807).
- CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read (bsc#1273922).
- CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds reads (bsc#1273925).
- CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory disclosure (bsc#1273924).
- CVE-2026-90462: Fail-open in LDAP ppolicy access check allows continued authorization (bsc#1282584).
- CVE-2026-90463: out-of-bounds read in the NSS service request parsers (bsc#1280360).
- CVE-2026-90994: out-of-bounds read in PAM v1 parser (bsc#1280361).
- CVE-2026-90995: NULL pointer dereference in PAM responder (bsc#1280362).
- CVE-2026-90996: zero-length request body underflow in the NSS responder (bsc#1280363).
- CVE-2026-92821: access control bypass due to premature LDAP access rule evaluation (bsc#1284326).
- CVE-2026-104029: denial of service due to out-of-bounds read in autofs responder (bsc#1284314).
- CVE-2026-104031: denial of service via memory exhaustion in autofs responder (bsc#1284316).
- CVE-2026-104033: access control bypass due to improper LDAP shadow expiration check (bsc#1284318).
- CVE-2026-104036: denial of service due to out-of-bounds write in NFS idmap plugin (bsc#1284321).
- CVE-2026-104037: denial of service due to packet length underflow in autofs responder (bsc#1284322).
- CVE-2026-104038: denial of service via missing SID extension in certificate mapping (bsc#1284323).
- CVE-2026-104039: denial of service due to stale connection state reuse in PAM GSSAPI responder (bsc#1284324).
- CVE-2026-104043: Denial of Service via undersized packet parsing in NSS responder (bsc#1284266).
- CVE-2026-104045: denial of service via race condition in autofs responder (bsc#1284470).
- Record
SUSE-SU-2026:5079-1- Updated
- 2026-11-03
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
sssdDebian:12 |
All versions, plus listed versions 2.10.1-12.10.1-22.11.1-12.11.1-22.11.1-2.1 Show 22 moreShow less2.12.0-12.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-42.8.2-42.8.2-4+deb12u12.9.1-12.9.1-22.9.2-12.9.4-12.9.4-1.12.9.4-1.1~exp12.9.4-22.9.5-12.9.5-22.9.5-32.9.5-42.9.5-5 |
None known |
sssdDebian:13 |
All versions, plus listed versions 2.10.1-22.11.1-12.11.1-22.11.1-2.12.12.0-1 Show 7 moreShow less2.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-4 |
None known |
sssdDebian:14 |
All versions, plus listed versions 2.10.1-22.11.1-12.11.1-22.11.1-2.12.12.0-1 Show 7 moreShow less2.12.0-22.12.0-3~exp02.12.0-42.13.1-12.13.1-22.13.1-32.13.1-4 |
None known |
sssdopenEuler:22.03-LTS-SP4 From an advisory covering 3 CVEs |
before 2.6.1-33.oe2203sp4 | 2.6.1-33.oe2203sp4 |
sssdopenEuler:24.03-LTS-SP1 From an advisory covering 3 CVEs |
before 2.9.4-27.oe2403sp1 | 2.9.4-27.oe2403sp1 |
sssdopenEuler:24.03-LTS-SP3 From an advisory covering 3 CVEs |
before 2.9.4-27.oe2403sp3 | 2.9.4-27.oe2403sp3 |
sssdopenEuler:24.03-LTS-SP4 From an advisory covering 3 CVEs |
before 2.9.4-27.oe2403sp4 | 2.9.4-27.oe2403sp4 |
sssdSUSE:Linux Enterprise Server 15 SP6-LTSS From an advisory covering 19 CVEs |
before 2.10.2-150600.3.58.1 | 2.10.2-150600.3.58.1 |
sssdSUSE:Linux Enterprise Server for SAP Applications 15 SP6 From an advisory covering 19 CVEs |
before 2.10.2-150600.3.58.1 | 2.10.2-150600.3.58.1 |
sssdUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 1.12.5-21.13.1-21.13.2-11.13.3-11.13.4-1 Show 15 moreShow less1.13.4-1ubuntu11.13.4-1ubuntu1.11.13.4-1ubuntu1.21.13.4-1ubuntu1.51.13.4-1ubuntu1.61.13.4-1ubuntu1.71.13.4-1ubuntu1.81.13.4-1ubuntu1.91.13.4-1ubuntu1.101.13.4-1ubuntu1.111.13.4-1ubuntu1.121.13.4-1ubuntu1.131.13.4-1ubuntu1.141.13.4-1ubuntu1.151.13.4-1ubuntu1.15+esm1 |
None known |
Show 6 moreShow less
| Package | Affected | Fixed |
|---|---|---|
sssdUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 1.15.3-2ubuntu11.15.3-3ubuntu11.16.0-5ubuntu11.16.0-5ubuntu21.16.1-1ubuntu1 Show 9 moreShow less1.16.1-1ubuntu1.11.16.1-1ubuntu1.21.16.1-1ubuntu1.31.16.1-1ubuntu1.41.16.1-1ubuntu1.51.16.1-1ubuntu1.61.16.1-1ubuntu1.71.16.1-1ubuntu1.81.16.1-1ubuntu1.8+esm1 |
None known |
sssdUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2.2.0-4ubuntu12.2.2-12.2.2-1ubuntu12.2.3-1.1ubuntu12.2.3-2 Show 14 moreShow less2.2.3-32.2.3-3ubuntu0.12.2.3-3ubuntu0.22.2.3-3ubuntu0.32.2.3-3ubuntu0.42.2.3-3ubuntu0.62.2.3-3ubuntu0.72.2.3-3ubuntu0.82.2.3-3ubuntu0.92.2.3-3ubuntu0.102.2.3-3ubuntu0.112.2.3-3ubuntu0.122.2.3-3ubuntu0.132.2.3-3ubuntu0.13+esm1 |
None known |
sssdUbuntu:22.04:LTS |
All versions, plus listed versions 2.4.1-2ubuntu42.5.2-4ubuntu12.5.2-4ubuntu32.5.2-4ubuntu42.6.1-1ubuntu3 Show 9 moreShow less2.6.3-1ubuntu32.6.3-1ubuntu3.12.6.3-1ubuntu3.22.6.3-1ubuntu3.32.6.3-1ubuntu3.42.6.3-1ubuntu3.52.6.3-1ubuntu3.62.6.3-1ubuntu3.82.6.3-1ubuntu3.9 |
None known |
sssdUbuntu:24.04:LTS |
All versions, plus listed versions 2.9.1-2ubuntu22.9.1-2ubuntu32.9.2-1ubuntu22.9.4-1ubuntu12.9.4-1.1ubuntu3 Show 10 moreShow less2.9.4-1.1ubuntu52.9.4-1.1ubuntu62.9.4-1.1ubuntu6.12.9.4-1.1ubuntu6.22.9.4-1.1ubuntu6.32.9.4-1.1ubuntu6.42.9.4-1.1ubuntu6.52.9.4-1.1ubuntu6.62.9.4-1.1ubuntu6.72.9.4-1.1ubuntu6.8 |
None known |
sssdUbuntu:26.10 |
All versions, plus listed versions 2.12.0-1ubuntu52.12.0-4ubuntu12.12.0-4ubuntu22.12.0-4ubuntu32.12.0-4ubuntu4 |
None known |
sssdUbuntu:26.04:LTS |
All versions, plus listed versions 2.10.1-2ubuntu52.10.1-2ubuntu72.12.0-1ubuntu32.12.0-1ubuntu42.12.0-1ubuntu5 Show 5 moreShow less2.12.0-1ubuntu5.12.12.0-1ubuntu5.22.12.0-1ubuntu5.32.12.0-1ubuntu5.42.12.0-1ubuntu5.5 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | OSV | |
| affected | OSV | |
| affected, facts | EUVD, NVD | |
| products | CVE List | |
| affected, aliases, facts, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-90994 is a medium vulnerability (CVSS 4.0) in Red Hat Enterprise Linux 10, published September 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.17%, the 6th percentile. No source names a fixed version.
References
access.redhat.com/security/cve/CVE-2026-90994
bugzilla.redhat.com/show_bug.cgi?id=2479455
nvd.nist.gov/vuln/detail/CVE-2026-90994
github.com/advisories/GHSA-m9pj-qp75-2h63
security-tracker.debian.org/tracker/CVE-2026-90994
openeuler.org/zh/security/security-bulletins/detail?id=openEuler-SA-2026-4284
Show 47 moreShow less
suse.com/support/update/announcement/2026/suse-su-20265079-1
bugzilla.suse.com/1269807
ubuntu.com/security/CVE-2026-90994
cve.org/CVERecord?id=CVE-2026-90994