CVE-2026-90996
Received Received - Intake

sssd NSS Responder Denial of Service via Zero-Length Request

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: redhat-SADP

Description
A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-15
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2026-90996
EUVD
EUVD-2026-77590

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat sssd *
red_hat sssd *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-191 The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service vulnerability in the System Security Services Daemon (SSSD). A local unprivileged user can send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This causes a buffer underflow in the request parsing logic, leading to an out-of-bounds read and potential crash of the NSS responder. The vulnerability affects system availability but does not allow remote exploitation or privilege escalation.

Detection Guidance

To detect this vulnerability, monitor the SSSD service for crashes or instability in the NSS responder. Check logs for segmentation faults or unexpected terminations in the NSS responder process. Commands like 'journalctl -u sssd-nss' or 'systemctl status sssd' may show issues. Ensure the NSS responder UNIX socket is not accessible to unprivileged users.

Impact Analysis

The impact is limited to local denial of service. The NSS responder may become unstable or terminate, affecting local user and group resolution services. This could disrupt system operations that rely on these services, but no data confidentiality or integrity issues occur. Exploitation requires local access to the NSS responder socket.

Compliance Impact

This vulnerability primarily impacts system availability by causing a denial-of-service condition in the NSS responder. It does not directly affect data confidentiality or integrity, which are key concerns for GDPR and HIPAA. However, prolonged unavailability of authentication or user resolution services could indirectly impact compliance by disrupting access to critical systems or data.

Mitigation Strategies

Immediately restrict access to the NSS responder UNIX socket or disable the NSS responder by editing /etc/sssd/sssd.conf to remove 'nss' from the 'services' line in the [sssd] section. Restart the SSSD service afterward. This may impact local user and group resolution.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90996. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart