SSSD CVE-2026-104041

Requires an interactive or unprivileged local account on a host running the SSSD daemon with the NSS responder enabled (SSSD's default responder for name resolution). The attacker exploits the negative-cache behavior by repeatedly requesting lookups for nonexistent NSS entries; no special non-default configuration is named in the description. Limiting factors that reduce realistic risk: exploitation is strictly LOCAL (no network vector), the attacker must already be authenticated as a local user (PR:L), and the only impact is availability of the SSSD responder - there is no confidentiality or integrity impact and no escalation of privilege. Impact is confined to hosts where SSSD mediates identity/authentication.

This is a moderate, availability-only Denial of Service issue, not a high-priority threat. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 5.5) is internally consistent with the description: exploitation requires LOCAL access as an already-authenticated unprivileged user (PR:L), has low attack complexity, needs no user interaction, and impacts only availability (C:N/I:N) of the SSSD NSS responder. No EPSS score, CISA KEV listing, or POC was provided in the input; per the precision rules this means no public exploit identified at time of analysis and no evidence of active exploitation. The absence of a remote vector (AV:L) sharply limits real-world risk - an attacker must already have a local account on the host. There is no privilege escalation or data exposure; the worst outcome is the SSSD responder becoming unresponsive or terminating, which can disrupt authentication/identity resolution on the affected host. Signals are consistent (no conflict between CVSS and description), so this should be treated as routine patch-management priority rather than an emergency. Note: EPSS and KEV data were absent from the input and could not be independently verified.

A logged-in unprivileged local user on a RHEL host running SSSD writes a simple loop that repeatedly queries the NSS responder for usernames or groups that do not exist (e.g. via getpwnam-style lookups for random names). Because the negative cache never caps its total size and only evicts expired records when an existing key is rechecked, memory consumption grows without bound until the SSSD responder is starved and crashes or hangs, denying identity/authentication services. No public exploit code was identified in the provided data, though the technique is trivial to script.