CVE-2026-104046: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 10

This vulnerability affects SSSD in Red Hat Enterprise Linux 10. The flaw involves the retention of state in memory for pre-authentication requests when IdP authentication is enabled. Because these states are not cleared or timed out, a local attacker can repeatedly start authentication flows without completion, causing unbounded memory growth. This can exhaust system memory resources, degrading or terminating the SSSD authentication service and causing a denial of service condition. The CVSS v3.1 score is 6.2, indicating a medium severity with local attack vector, low attack complexity, no privileges required, no user interaction, and impact limited to availability.

The vulnerability allows a local attacker to cause unbounded memory consumption by repeatedly initiating incomplete authentication flows, which can degrade or terminate SSSD authentication services. This results in a denial of service affecting system authentication availability. There is no impact on confidentiality or integrity according to the CVSS vector. No known exploits are reported in the wild.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-104046 for current remediation guidance. Until an official fix is available, consider limiting local user access or monitoring for abnormal authentication request patterns to reduce risk. No vendor advisory states that no action is required or that the issue is already mitigated.