A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security… (CVE-2026-104038)

CVE-2026-104038 is a denial of service vulnerability in sssd caused by improper handling of certificates lacking the expected Security Identifier (SID) extension. In deployments where SID-based certificate mapping is configured, sssd fails to check for the presence of the SID extension before processing the certificate. This leads to a crash of the sssd process during authentication or lookup, resulting in a denial of service. The vulnerability affects numerous specific versions of sssd as listed, with no known exploits in the wild. The CVSS 3.1 base score is 5.9, reflecting network attack vector, high attack complexity, no privileges required, no user interaction, unchanged scope, and impact on availability only.

The vulnerability allows a remote attacker to cause a denial of service by crashing the sssd process during authentication or lookup operations when a certificate without the expected SID extension is submitted. This impacts service availability but does not affect confidentiality or integrity. There are no known exploits in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a patch is available, administrators should review their SID-based certificate mapping configurations and consider additional validation controls to prevent processing of malformed certificates. Monitor vendor channels for updates and apply official fixes once released.