Medium
sssd — security advisory
A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash.
- Products
- sssd
- Affected versions
- 2.10.1-1, 2.10.1-2, 2.11.1-1, 2.11.1-2, 2.11.1-2.1, 2.12.0-1, 2.12.0-2, 2.12.0-3~exp0, 2.12.0-4, 2.13.1-1, 2.13.1-2, 2.13.1-3, 2.8.2-4, 2.8.2-4+deb12u1, 2.9.1-1, 2.9.1-2, 2.9.2-1, 2.9.4-1, 2.9.4-1.1, 2.9.4-1.1~exp1, 2.9.4-2, 2.9.5-1, 2.9.5-2, 2.9.5-3, 2.9.5-4, 2.9.5-5
- Fixed versions
- Not specified
- CVEs
- CVE-2026-104042
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 28 Oct 2026, 09:02 UTC · Revision 1
Source evidence
A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash.
osv:DEBIAN-CVE-2026-104042
sssd
Fixed versions: Not specified
sssd
Fixed versions: Not specified
Complete source record
{
"id": "4248fd7b3bf6de96cb62204b67ffde0d78fc99e5fd1ca3e3067fba09b231d880",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2026-104042",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2026-104042",
"summary": "A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash.",
"evidence": "osv:DEBIAN-CVE-2026-104042",
"products": [
{
"name": {
"value": "sssd",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.10.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.10.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.11.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.11.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.11.1-2.1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.0-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.0-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.0-3~exp0",
"evidence": "/affected/0/versions"
},
{
"value": "2.12.0-4",
"evidence": "/affected/0/versions"
},
{
"value": "2.13.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.13.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.13.1-3",
"evidence": "/affected/0/versions"
},
{
"value": "2.8.2-4",
"evidence": "/affected/0/versions"
},
{
"value": "2.8.2-4+deb12u1",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.1-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.1-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.2-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.4-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.4-1.1",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.4-1.1~exp1",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.4-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.5-1",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.5-2",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.5-3",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.5-4",
"evidence": "/affected/0/versions"
},
{
"value": "2.9.5-5",
"evidence": "/affected/0/versions"
}
]
},
{
"name": {
"value": "sssd",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": [
{
"value": "2.10.1-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.11.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.11.1-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.11.1-2.1",
"evidence": "/affected/1/versions"
},
{
"value": "2.12.0-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.12.0-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.12.0-3~exp0",
"evidence": "/affected/1/versions"
},
{
"value": "2.12.0-4",
"evidence": "/affected/1/versions"
},
{
"value": "2.13.1-1",
"evidence": "/affected/1/versions"
},
{
"value": "2.13.1-2",
"evidence": "/affected/1/versions"
},
{
"value": "2.13.1-3",
"evidence": "/affected/1/versions"
}
]
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2026-104042",
"aliases": [
"DEBIAN-CVE-2026-104042"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "sssd",
"purl": "pkg:deb/debian/sssd?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"versions": [
"2.10.1-1",
"2.10.1-2",
"2.11.1-1",
"2.11.1-2",
"2.11.1-2.1",
"2.12.0-1",
"2.12.0-2",
"2.12.0-3~exp0",
"2.12.0-4",
"2.13.1-1",
"2.13.1-2",
"2.13.1-3",
"2.8.2-4",
"2.8.2-4+deb12u1",
"2.9.1-1",
"2.9.1-2",
"2.9.2-1",
"2.9.4-1",
"2.9.4-1.1",
"2.9.4-1.1~exp1",
"2.9.4-2",
"2.9.5-1",
"2.9.5-2",
"2.9.5-3",
"2.9.5-4",
"2.9.5-5"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104042.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "sssd",
"purl": "pkg:deb/debian/sssd?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"2.10.1-2",
"2.11.1-1",
"2.11.1-2",
"2.11.1-2.1",
"2.12.0-1",
"2.12.0-2",
"2.12.0-3~exp0",
"2.12.0-4",
"2.13.1-1",
"2.13.1-2",
"2.13.1-3"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-104042.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-08T09:47:36.055993607Z",
"provider": "osv",
"upstream": [
"CVE-2026-104042"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2026-104042"
]
},
"related_cves": [
{
"value": "CVE-2026-104042",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 98907,
"published_at": "2026-10-06T02:17:03.47+00:00"
}