A flaw was found in SSSD. In configurations where the autofs responder service is enabled, memory allocated during successful request processing is… (CVE-2026-104031)

CVE-2026-104031 describes a vulnerability in SSSD where, if the autofs responder service is enabled, memory allocated during successful request processing is retained until the client connection closes. This allows a local attacker to cause memory exhaustion by keeping a connection open and sending repeated valid requests, resulting in a Denial of Service condition. The vulnerability affects multiple specific versions of SSSD as listed, and no known exploits are reported in the wild.

The impact is a Denial of Service (DoS) caused by memory exhaustion on the affected system. There is no impact on confidentiality or integrity. The attacker must have local access and the ability to maintain an open connection to exploit this flaw.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, limit local access to trusted users and monitor for unusual resource consumption related to SSSD autofs responder service connections.