{"schemaVersion":3,"id":"CVE-2026-104045","aliases":["UBUNTU-CVE-2026-104045","DEBIAN-CVE-2026-104045"],"status":"published","duplicateOf":null,"title":null,"description":"A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.","dates":{"published":"2026-10-06T20:37:41.257Z","modified":"2026-10-16T10:57:51.223Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":4.7,"severity":"medium","version":"3.1","versionLabel":"v3.1","source":"CVE.org","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","computed":false,"selection":"backend-summary"},"metrics":[{"version":"3.1","versionLabel":"v3.1","source":"CVE.org","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Ubuntu","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":2.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"OSV · Debian","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":2.6,"impact":6,"computed":true},{"version":"3.1","versionLabel":"v3.1","source":"NVD","score":4.7,"severity":"medium","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","exploitability":null,"impact":null,"computed":false}]},"epss":{"probability":0.001,"percentile":0.00791,"severity":"low","asOf":"2026-10-21T00:00:00.000Z","change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[{"date":"2026-10-07T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.001,"percentile":0.00791}],"last30":[{"date":"2026-10-07T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-08T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-09T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-10T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-11T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-12T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-13T00:00:00.000Z","score":0.00095,"percentile":null},{"date":"2026-10-14T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-15T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-16T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-17T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-18T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-19T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-20T00:00:00.000Z","score":0.001,"percentile":null},{"date":"2026-10-21T00:00:00.000Z","score":0.001,"percentile":0.00791}]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[{"id":"REF_2802DF4E47CCD184","name":"Exploit Reference (bugzilla.redhat.com)","source":"reference","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478663","maturity":"unknown","reliabilityScore":0.2,"verified":false,"type":null,"platforms":[],"requiresAuth":null,"exploitdb":null,"metasploit":null}],"exploitCount":1,"weaknesses":[{"id":"CWE-772","name":"Missing Release of Resource after Effective Lifetime","description":"The product does not release a resource after its effective lifetime has ended, i.e., after the resource is no longer needed.","type":"weakness","status":"Draft","abstraction":"Base","likelihoodOfExploit":"High","url":"https://cwe.mitre.org/data/definitions/772.html"}],"affected":[{"vendor":"debian","product":"sssd","name":"sssd","label":"sssd","ecosystem":"Debian","cpePart":null,"purl":"pkg:deb/debian/sssd","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"ubuntu","product":"sssd","name":"sssd","label":"sssd","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/sssd","purlType":"deb","versions":[{"text":"All versions","noFixRecorded":true,"fixedIn":null}],"versionsText":"All versions (No fix recorded)","eol":null,"hubHref":null},{"vendor":"fedoraproject","product":"sssd","name":"sssd","label":"sssd","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"2.12.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"2.12.0","eol":null,"hubHref":"/vendor/fedoraproject/sssd"},{"vendor":"redhat","product":"enterprise_linux","name":"enterprise linux","label":"enterprise_linux","ecosystem":null,"cpePart":"o","purl":null,"purlType":null,"versions":[{"text":"7.0","noFixRecorded":false,"fixedIn":null},{"text":"8.0","noFixRecorded":false,"fixedIn":null},{"text":"9.0","noFixRecorded":false,"fixedIn":null},{"text":"10.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"7.0 | 8.0 | 9.0 | 10.0","eol":{"isEol":true,"eolDate":"2024-06-30T00:00:00.000Z","matchMethod":"cpe","cycle":{"name":"7","label":"7 (ELS)","eolFrom":"2024-06-30T00:00:00.000Z","isLts":true,"isMaintained":true,"latestVersion":"7.9"},"product":{"name":"rhel","label":"Red Hat Enterprise Linux","category":"os"}},"hubHref":"/vendor/redhat/enterprise_linux"},{"vendor":"redhat","product":"openshift_container_platform","name":"openshift container platform","label":"openshift_container_platform","ecosystem":null,"cpePart":"a","purl":null,"purlType":null,"versions":[{"text":"4.0","noFixRecorded":false,"fixedIn":null}],"versionsText":"4.0","eol":null,"hubHref":"/vendor/redhat/openshift_container_platform"}],"affectedCount":5,"eol":{"hasEol":true,"count":1},"references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-104045","label":"access.redhat.com/security/cve/CVE-2026-104045","hostname":"access.redhat.com","tags":["VDB Entry","X Refsource REDHAT","Vendor Advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2478663","label":"bugzilla.redhat.com/show_bug.cgi?id=2478663","hostname":"bugzilla.redhat.com","tags":["Issue Tracking","X Refsource REDHAT","REPORT","Exploit","Mitigation","Vendor Advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-104045","label":"ubuntu.com/security/CVE-2026-104045","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-104045","label":"www.cve.org/CVERecord?id=CVE-2026-104045","hostname":"www.cve.org","tags":["REPORT"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-104045","label":"security-tracker.debian.org/tracker/CVE-2026-104045","hostname":"security-tracker.debian.org","tags":["Advisory"]}],"lineage":{"upstream":[],"downstream":[],"duplicates":[],"related":[]},"timeline":[{"kind":"published","date":"2026-10-06T20:37:41.257Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-10-16T10:57:51.223Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":29,"level":"medium","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-22T09:12:34.940Z","stale":false,"partial":false}}