DEBIAN-CVE-2026-90463
A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds read. This out-of-bounds read may lead to a denial of service (DoS) by crashing the NSS responder process. While unprivileged local clients can typically reach the socket, there is no evidence of privilege escalation or reliable data disclosure.
DEBIAN-CVE-2026-90463
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-90463
sssd
Source reference: /affected/0/package/name
- Affected versions
- 2.10.1-1
Source reference:
/affected/0/versions2.10.1-2Source reference:
/affected/0/versions2.11.1-1Source reference:
/affected/0/versions2.11.1-2Source reference:
/affected/0/versions2.11.1-2.1Source reference:
/affected/0/versions2.12.0-1Source reference:
/affected/0/versions2.12.0-2Source reference:
/affected/0/versions2.12.0-3~exp0Source reference:
/affected/0/versions2.12.0-4Source reference:
/affected/0/versions2.13.1-1Source reference:
/affected/0/versions2.13.1-2Source reference:
/affected/0/versions2.13.1-3Source reference:
/affected/0/versions2.8.2-4Source reference:
/affected/0/versions2.8.2-4+deb12u1Source reference:
/affected/0/versions2.9.1-1Source reference:
/affected/0/versions2.9.1-2Source reference:
/affected/0/versions2.9.2-1Source reference:
/affected/0/versions2.9.4-1Source reference:
/affected/0/versions2.9.4-1.1Source reference:
/affected/0/versions2.9.4-1.1~exp1Source reference:
/affected/0/versions2.9.4-2Source reference:
/affected/0/versions2.9.5-1Source reference:
/affected/0/versions2.9.5-2Source reference:
/affected/0/versions2.9.5-3Source reference:
/affected/0/versions2.9.5-4Source reference:
/affected/0/versions2.9.5-5Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
sssd
Source reference: /affected/1/package/name
- Affected versions
- 2.10.1-2
Source reference:
/affected/1/versions2.11.1-1Source reference:
/affected/1/versions2.11.1-2Source reference:
/affected/1/versions2.11.1-2.1Source reference:
/affected/1/versions2.12.0-1Source reference:
/affected/1/versions2.12.0-2Source reference:
/affected/1/versions2.12.0-3~exp0Source reference:
/affected/1/versions2.12.0-4Source reference:
/affected/1/versions2.13.1-1Source reference:
/affected/1/versions2.13.1-2Source reference:
/affected/1/versions2.13.1-3Source reference:
/affected/1/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "sssd",
"purl": "pkg:deb/debian/sssd?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.10.1-1",
"2.10.1-2",
"2.11.1-1",
"2.11.1-2",
"2.11.1-2.1",
"2.12.0-1",
"2.12.0-2",
"2.12.0-3~exp0",
"2.12.0-4",
"2.13.1-1",
"2.13.1-2",
"2.13.1-3",
"2.8.2-4",
"2.8.2-4+deb12u1",
"2.9.1-1",
"2.9.1-2",
"2.9.2-1",
"2.9.4-1",
"2.9.4-1.1",
"2.9.4-1.1~exp1",
"2.9.4-2",
"2.9.5-1",
"2.9.5-2",
"2.9.5-3",
"2.9.5-4",
"2.9.5-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-90463.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "sssd",
"purl": "pkg:deb/debian/sssd?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.10.1-2",
"2.11.1-1",
"2.11.1-2",
"2.11.1-2.1",
"2.12.0-1",
"2.12.0-2",
"2.12.0-3~exp0",
"2.12.0-4",
"2.13.1-1",
"2.13.1-2",
"2.13.1-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-90463.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #58413 · Revision 1
- Added to Heist Feed
- Publisher date