CVE-2026-104031

The record

A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is not released until the client connection terminates. A local attacker can exploit this vulnerability by maintaining an open connection and repeatedly submitting valid requests, leading to memory exhaustion and a Denial of Service (DoS).

Affected packages

Related vulnerabilities

• CVE-2026-90870 A missing release of backend receiver sessions in the Ad Hoc Transfer component of… CWE-772
• CVE-2026-112200 P-Net before 1.0.3 does not release the Application Relationship (AR) and the RPC session… CWE-772
• CVE-2026-115793 P-Net before 1.0.3 does not release the RPC session allocated for an RPC request that… CWE-772
• CVE-2026-118262 Echo is a Go web framework. CWE-772
• CVE-2026-114236 storage/pkg/archive.ApplyLayer and ApplyUncompressedLayer may, when processing corrupt or… CWE-772
• CVE-2026-59951 The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context… CWE-772
• CVE-2026-18149 undici's retry handler can leave an already-exposed response body pending forever. CWE-772
• CVE-2026-71380 Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets… CWE-772