Two vulnerabilities were identified in sssd affecting its NFS idmap plugin and certificate processing. The first flaw (CVE-2026-104036) allows a local attacker to cause an out-of-bounds write leading to denial of service by triggering identity lookups with oversized cached entries. The second flaw (CVE-2026-104038) permits a remote attacker to cause denial of service by submitting a certificate missing an expected SID extension in SID-based certificate mapping deployments. Both issues result primarily in service crashes. A fixed version 2.9.4-30.oe2403sp3 is available.