CVE-2026-104045
A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation.
Does this matter?
Lower severity and a low EPSS score (0.13%). Track it; it rarely justifies an emergency change on its own.
Description
A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.
- CVSS 3.1
- 4.7 MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
- EPSS
- 0.13% probability · 2th percentile
- Public exploits
- None in Exploit-DB
- CISA KEV
- Not listed
- Weakness
- CWE-772
- Affected
- fedoraproject/sssd · redhat/openshift container platform · redhat/enterprise linux
- Source
- secalert@redhat.com
EPSS moved from 0.1% on 7 October 2026 to 0.1% on 26 October 2026.
References
- https://access.redhat.com/security/cve/CVE-2026-104045Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2478663Exploit, Issue Tracking, Mitigation, Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2478663Exploit, Issue Tracking, Mitigation, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.