Export limit exceeded: 419920 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (419920 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-104046 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 6.2 Medium |
| A flaw was found in SSSD (System Security Services Daemon). When Identity Provider (IdP) authentication is enabled, pre-authentication requests retain state in memory without being cleared or timed out. A local attacker can repeatedly initiate authentication flows without completing them, causing unbounded memory consumption. This memory exhaustion can lead to a Denial of Service (DoS) by degrading or terminating SSSD authentication services. | ||||
| CVE-2026-104045 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 4.7 Medium |
| A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service. | ||||
| CVE-2026-104044 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 6.2 Medium |
| A flaw was found in sssd. A local attacker can trigger a Denial of Service (DoS) by sending a specially crafted Pluggable Authentication Module (PAM) request when passkey authentication is enabled. Due to a missing state validation check in passkey Kerberos handling, the PAM responder dereferences an uninitialized pointer and crashes. This failure disrupts authentication services on the host. | ||||
| CVE-2026-104043 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. A local attacker with access to the Name Service Switch (NSS) responder UNIX socket can trigger an integer underflow by sending a specially crafted request with an undersized packet header. This issue causes an out-of-bounds memory read during packet parsing, crashing the responder process and resulting in a Denial of Service (DoS). | ||||
| CVE-2026-104042 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in sssd. A local attacker can cause a Denial of Service (DoS) by sending a crafted Pluggable Authentication Module (PAM) request containing a zero-length authentication token to the responder socket. Due to missing input validation, the service attempts to read beyond buffer boundaries when processing the token, causing the PAM responder to crash. | ||||
| CVE-2026-104041 | 2 Redhat, Sssd | 4 Enterprise Linux, Openshift, Rhel Els and 1 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates. | ||||
| CVE-2026-104040 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 4.4 Medium |
| A flaw was found in SSSD. When configured with the Entra ID identity provider, input lookup names containing single quotes are not properly escaped before being included in Microsoft Graph Open Data Protocol (OData) queries. A low-privileged local user can exploit this flaw by submitting a crafted search request, altering query filters to broaden user or group searches. This can lead to information disclosure by retrieving unintended directory objects, as well as a Denial of Service (DoS) through excessive processing and cache population. | ||||
| CVE-2026-104039 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 4.7 Medium |
| A flaw was found in SSSD. A local user can cause a denial of service (DoS) by disrupting system authentication services. When handling Generic Security Services Application Programming Interface (GSSAPI) authentication in the Pluggable Authentication Module (PAM) responder, cached connection state is freed upon completion without clearing the reference pointer. An attacker can exploit this by sending an additional request over the same connection, causing the service to access invalid memory and unexpectedly terminate. | ||||
| CVE-2026-104038 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.9 Medium |
| A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to verify the presence of the extension before processing it, causing the process to crash during authentication or lookup operations. | ||||
| CVE-2026-104037 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. A local attacker can exploit this issue by sending a specially crafted request with an invalid packet length to the autofs responder UNIX socket. This causes an integer underflow and an out-of-bounds memory read, which can crash the responder process and result in a denial of service (DoS). | ||||
| CVE-2026-104036 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.8 Medium |
| A flaw was found in SSSD's NFS idmap plugin. When retrieving cached user or group names, the plugin detects if an entry exceeds the destination buffer size but fails to abort before copying data. A local attacker can trigger this vulnerability by requesting identity lookups that resolve to oversized cached entries, resulting in an out-of-bounds write. This flaw primarily leads to a Denial of Service (DoS) by crashing the identity mapping service, and may also corrupt adjacent process memory. | ||||
| CVE-2026-104035 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. An issue in the Kerberos Credential Manager (KCM) responder allows a local user to cause a Denial of Service (DoS) by maintaining a persistent connection and repeatedly storing and destroying credentials. Because the service fails to release cached objects from memory when credentials are removed, memory consumption grows continuously, ultimately exhausting available memory and rendering the service unresponsive. | ||||
| CVE-2026-104034 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 4.7 Medium |
| A flaw was found in SSSD. A use-after-free vulnerability exists in the Kerberos Credential Manager (KCM) responder during Kerberos ticket-granting ticket (TGT) renewal, where a deferred callback accesses memory that has already been released. An authenticated local user with a renewable Kerberos ticket can trigger this issue on systems configured with KCM renewal, causing the KCM responder service to crash and resulting in a Denial of Service (DoS). | ||||
| CVE-2026-104033 | 2 Redhat, Sssd | 5 Enterprise Linux, Openshift, Openshift Container Platform and 2 more | 2026-11-05 | 5.4 Medium |
| A flaw was found in SSSD. When configured to enforce account expiration using LDAP (Lightweight Directory Access Protocol) shadow attributes, SSSD fails to treat an expiration value of zero as an expired account. A user with valid credentials for an expired account can exploit this flaw to bypass access controls and authenticate to the system. This allows unauthorized access to persist after the account was intended to be deactivated. | ||||
| CVE-2026-104032 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. An unprivileged local user can repeatedly request master automount map updates through the autofs responder due to missing authorization checks. This triggers global cache invalidation and forces repeated lookups to backend directory providers, leading to a Denial of Service (DoS) from degraded automount availability and elevated resource consumption. | ||||
| CVE-2026-104031 | 4 Fedoraproject, Red Hat, Redhat and 1 more | 7 Sssd, Enterprise Linux, Enterprise Linux and 4 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS). | ||||
| CVE-2026-104030 | 3 Fedoraproject, Redhat, Sssd | 6 Sssd, Enterprise Linux, Openshift and 3 more | 2026-11-05 | 5.5 Medium |
| A flaw was found in sssd. This vulnerability allows a local user to cause a Denial of Service (DoS) by submitting a specially crafted passkey authentication token that lacks null terminators. The authentication service reads past the end of the provided memory buffer, causing the process to crash and disrupting authentication services. | ||||
| CVE-2026-103641 | 2 Gegl, Redhat | 3 Gegl, Enterprise Linux, Rhel Els | 2026-11-05 | 5.5 Medium |
| A flaw was found in GEGL. The Radiance HDR loader reads past the end of a memory-mapped image when an uncompressed scanline is shorter than the width declared in the file header. Opening a crafted HDR file crashes the application that uses the loader. | ||||
| CVE-2026-103399 | 2 Red Hat, Redhat | 3 Enterprise Linux, Enterprise Linux, Rhel Els | 2026-11-05 | 5.3 Medium |
| A flaw was found in SoupServer (libsoup). When an HTTP/1.x client sends a request with Expect: 100-continue and a request body, and SoupServer returns an early final (non-1xx) response before the body is read, the server neither drains the declared body bytes nor closes the connection. On a keep-alive connection, those leftover bytes are interpreted as a subsequent HTTP request. A remote, unauthenticated attacker can place a complete HTTP request in the body and cause SoupServer to process that smuggled request, leading to unintended request handling. | ||||
| CVE-2026-103242 | 1 Redhat | 3 Enterprise Linux, Hummingbird, Rhel Els | 2026-11-05 | 7.1 High |
| A heap-based buffer overflow flaw was found in rpm. RPMTAG_FILESIGNATURES in a crafted, unsigned RPM package's main header is declared with the wrong header type, causing hex2binv() to allocate a one-byte buffer and then write the tag's attacker-controlled, hex-decoded content — of attacker-chosen length — past the end of that allocation. This is reachable via rpm2cpio, rpm2archive, and rpm -qlvp on an untrusted package. | ||||