Two security flaws were identified in sssd, a system service managing access to remote directories and authentication. The first flaw (CVE-2026-104036) involves an out-of-bounds write in the NFS idmap plugin when handling oversized cached user or group names, potentially causing a denial of service (DoS) or memory corruption. The second flaw (CVE-2026-104038) allows a remote attacker to cause a DoS by submitting a certificate missing a required Security Identifier (SID) extension, crashing the service during authentication or lookup. A patch fixing these issues is available in version 2.9.4-30.oe2403sp4.