Cloudanix VulnDB

CVE-2026-104041

Medium · 5.5

CVSS

5.5

EPSS

0.1%

Published

Oct 6, 2026

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A regular user on the computer can keep asking for names that do not exist, causing the system service that looks up user information to use more and more memory until it stops working and disrupts logins and other services.

Exploitation
Local Privilege
Attacker needs
Low Privilege
Complexity
Low
Impact
Denial Of Service
Component
Application
Class
Denial of service
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Unprivileged local user triggers unbounded growth of the negative cache in the SSSD NSS responder by repeatedly requesting lookups for nonexistent entries; the cache never limits total size and only evicts on recheck of existing keys, exhausting responder memory and causing the process to become unresponsive or terminate.

Why it matters to the business

Authentication and name-resolution services on affected systems can be disrupted, leading to login failures, application outages, and potential loss of access to resources that depend on SSSD for identity information.

How an attack unfolds

An attacker with local unprivileged access issues repeated NSS lookup requests for nonexistent users or groups; each request adds an entry to the negative cache without size limits, steadily consuming memory until the responder crashes or stops answering queries.

How to fix it

Update SSSD to a version containing the fix for unbounded negative-cache growth once released; in the interim, monitor memory usage of the NSS responder and consider temporary workarounds such as limiting NSS request rates or restarting the service on memory pressure.

How to confirm the fix worked

After applying updates, confirm the negative cache size remains bounded under repeated nonexistent lookups by monitoring memory and cache statistics; verify the responder continues to answer queries without exhaustion.

Typical attack path

  1. Obtain local unprivileged shell access on a system running SSSD
  2. Repeatedly invoke getent or equivalent NSS lookup calls for nonexistent names
  3. Monitor memory consumption of the sssd_nss responder process
  4. Continue until memory exhaustion causes the responder to terminate or hang

How to detect it

Review system logs and process metrics for sustained high memory usage or repeated crashes of the sssd_nss responder; correlate with high volumes of NSS lookup requests for nonexistent entries from local processes.

What your security team should do

  • Prioritize patching SSSD as soon as a fixed release is available
  • Add monitoring for sssd_nss memory usage and unexpected restarts
  • Review local access controls to reduce the number of unprivileged accounts that can perform NSS lookups

The record

A flaw was found in SSSD. An unprivileged local user can repeatedly request lookups for nonexistent entries through the Name Service Switch (NSS) responder. Because the negative cache does not limit the total number of stored entries and only removes expired records when an existing key is rechecked, the cache can grow without bound. This behavior can lead to memory exhaustion, resulting in a Denial of Service (DoS) as the responder becomes unresponsive or terminates.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities