GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-90996 (GCVE-0-2026-90996)

Vulnerability from cvelistv5 – Published: 2026-09-14 15:55 – Updated: 2026-09-16 15:15
VLAI
Title
Sssd: sssd: denial of service in nss responder via crafted zero-length requests
Summary
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.
Severity
4 (Medium)
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-16 15:15 UTC
CWE
  • CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
URL Tags
https://access.redhat.com/security/cve/CVE-2026-90996 vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2478986 issue-trackingx_refsource_REDHAT
Impacted products
Date Public
2026-09-14 14:50
Credits
This issue was discovered by Found by AISLE in partnership with Red Hat.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-90996",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-16T15:15:17.094579Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-16T15:15:29.002Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:10"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 10",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:6"
          ],
          "defaultStatus": "unknown",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:7"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 7",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:8"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 8",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/o:redhat:enterprise_linux:9"
          ],
          "defaultStatus": "affected",
          "packageName": "sssd",
          "product": "Red Hat Enterprise Linux 9",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-8",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:openshift:4"
          ],
          "defaultStatus": "affected",
          "packageName": "openshift/ose-rhel-coreos-9",
          "product": "Red Hat OpenShift Container Platform 4",
          "vendor": "Red Hat"
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "This issue was discovered by Found by AISLE in partnership with Red Hat."
        }
      ],
      "datePublic": "2026-09-14T14:50:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "LOW",
            "baseScore": 4,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
            "version": "3.1"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-191",
              "description": "Integer Underflow (Wrap or Wraparound)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-09-14T17:37:10.092Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2026-90996"
        },
        {
          "name": "RHBZ#2478986",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2478986"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2026-05-18T03:32:25.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2026-09-14T14:50:00.000Z",
          "value": "Made public."
        }
      ],
      "title": "Sssd: sssd: denial of service in nss responder via crafted zero-length requests",
      "workarounds": [
        {
          "lang": "en",
          "value": "To mitigate this issue, restrict access to the NSS responder UNIX socket or disable the NSS responder if it is not required. The NSS responder can be disabled by editing the `/etc/sssd/sssd.conf` file and removing `nss` from the `services` line in the `[sssd]` section. After modifying the configuration, restart the SSSD service for the changes to take effect. Disabling the NSS responder may impact local user and group resolution.\n\nExample:\n```bash\n# Remove \u0027nss\u0027 from the services line in /etc/sssd/sssd.conf\n# Before: services = nss, pam, autofs\n# After: services = pam, autofs\n\nsudo systemctl restart sssd\n```\nWarning: Restarting the `sssd` service will temporarily interrupt authentication and authorization services."
        }
      ],
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-191: Integer Underflow (Wrap or Wraparound)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2026-90996",
    "datePublished": "2026-09-14T15:55:42.351Z",
    "dateReserved": "2026-09-14T14:46:11.065Z",
    "dateUpdated": "2026-09-16T15:15:29.002Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-90996",
      "date": "2026-09-16",
      "epss": "0.0011",
      "percentile": "0.01461"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-90996\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2026-09-14T16:17:42.517\",\"lastModified\":\"2026-09-16T19:42:43.623\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.\"}],\"affected\":[{\"source\":\"secalert@redhat.com\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 10\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"sssd\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:10\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 6\",\"defaultStatus\":\"unknown\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"sssd\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"sssd\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"sssd\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"sssd\",\"cpes\":[\"cpe:/o:redhat:enterprise_linux:9\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift/ose-rhel-coreos-8\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Container Platform 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift/ose-rhel-coreos-9\",\"cpes\":[\"cpe:/a:redhat:openshift:4\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\",\"baseScore\":4.0,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"LOW\"},\"exploitabilityScore\":2.5,\"impactScore\":1.4}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-16T15:15:17.094579Z\",\"id\":\"CVE-2026-90996\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"secalert@redhat.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-191\"}]}],\"references\":[{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-90996\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2478986\",\"source\":\"secalert@redhat.com\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-09-14T17:37:05+00:00",
      "cve": "CVE-2026-90996",
      "id": "CVE-2026-90996",
      "initial_release_date": "2026-09-14T14:50:00+00:00",
      "product_status:known_affected": "166",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "sssd: sssd: Denial of Service in NSS responder via crafted zero-length requests",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-90996.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T23:58:35Z",
      "cve": "CVE-2026-90996",
      "id": "CVE-2026-90996",
      "initial_release_date": "2026-09-15T23:58:35Z",
      "product_status:known_affected": "937",
      "product_status:known_not_affected": "1",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-90996",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-90996.json",
      "version": "2"
    },
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Sssd: sssd: denial of service in nss responder via crafted zero-length requests\", \"metrics\": [{\"other\": {\"content\": {\"value\": \"Moderate\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}, \"type\": \"Red Hat severity rating\"}}, {\"cvssV3_1\": {\"attackComplexity\": \"LOW\", \"attackVector\": \"LOCAL\", \"availabilityImpact\": \"LOW\", \"baseScore\": 4, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"NONE\", \"privilegesRequired\": \"NONE\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L\", \"version\": \"3.1\"}, \"format\": \"CVSS\"}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.\"}], \"affected\": [{\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 10\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"sssd\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:10\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 6\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"sssd\", \"defaultStatus\": \"unknown\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:6\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 7\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"sssd\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:7\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"sssd\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:8\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux 9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"sssd\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/o:redhat:enterprise_linux:9\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"openshift/ose-rhel-coreos-8\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/a:redhat:openshift:4\"]}, {\"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Container Platform 4\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"packageName\": \"openshift/ose-rhel-coreos-9\", \"defaultStatus\": \"affected\", \"cpes\": [\"cpe:/a:redhat:openshift:4\"]}], \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-90996\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2478986\", \"name\": \"RHBZ#2478986\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}], \"datePublic\": \"2026-09-14T14:50:00.000Z\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-191\", \"description\": \"Integer Underflow (Wrap or Wraparound)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"x_redhatCweChain\": \"CWE-191: Integer Underflow (Wrap or Wraparound)\", \"workarounds\": [{\"lang\": \"en\", \"value\": \"To mitigate this issue, restrict access to the NSS responder UNIX socket or disable the NSS responder if it is not required. The NSS responder can be disabled by editing the `/etc/sssd/sssd.conf` file and removing `nss` from the `services` line in the `[sssd]` section. After modifying the configuration, restart the SSSD service for the changes to take effect. Disabling the NSS responder may impact local user and group resolution.\\n\\nExample:\\n```bash\\n# Remove \u0027nss\u0027 from the services line in /etc/sssd/sssd.conf\\n# Before: services = nss, pam, autofs\\n# After: services = pam, autofs\\n\\nsudo systemctl restart sssd\\n```\\nWarning: Restarting the `sssd` service will temporarily interrupt authentication and authorization services.\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-18T03:32:25.000Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-09-14T14:50:00.000Z\", \"value\": \"Made public.\"}], \"credits\": [{\"lang\": \"en\", \"value\": \"This issue was discovered by Found by AISLE in partnership with Red Hat.\"}], \"providerMetadata\": {\"orgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"shortName\": \"redhat\", \"dateUpdated\": \"2026-09-14T17:37:10.092Z\"}, \"x_generator\": {\"engine\": \"cvelib 1.8.0\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-90996\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-16T15:15:17.094579Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-16T15:15:23.111Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-90996\", \"assignerOrgId\": \"53f830b8-0a3f-465b-8143-3b8a9948e749\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"redhat\", \"dateReserved\": \"2026-09-14T14:46:11.065Z\", \"datePublished\": \"2026-09-14T15:55:42.351Z\", \"dateUpdated\": \"2026-09-16T15:15:29.002Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.