EUVD-2026-77590

| CVE-2026-90996 MEDIUM

Integer Underflow (CWE-191)

2026-09-14 secalert@redhat.com

GHSA-xg93-wm7f-rmcx

Information Disclosure Integer Overflow

4.0

CVSS 3.1 · Vendor: redhat

Severity by source

Vendor (redhat) PRIMARY

4.0 MEDIUM

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Primary rating from Vendor (redhat) · only source for this CVE.

CVSS VectorVendor: redhat

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

Low

Lifecycle Timeline

Analysis Generated

Sep 15, 2026 - 11:36 vuln.today

DescriptionCVE.org

A flaw was found in sssd. A local unprivileged user could send a specially crafted request with a zero-length body to the Network Security Services (NSS) responder. This could lead to a denial-of-service condition, causing the NSS responder to become unstable or terminate. This vulnerability affects the availability of the system responder.

AnalysisAI

Local unprivileged users on hosts running the System Security Services Daemon (SSSD) can crash or destabilize the NSS responder by sending a crafted zero-length request to its socket, degrading name-service lookups for every process on the machine. The defect is an integer underflow (CWE-191) in the responder's request parsing, and it is scored CVSS 4.0 because only availability is impacted and the attack requires local access to the host. …