CVE-2026-104045

Katalog CVE

CVSS 4.7 · Medium EPSS 0,10%

Kerentanan Missing Release of Resource after Effective Lifetime pada fedoraproject sssd, redhat openshift container platform +1 lainnya. Skor CVSS 3.1 4.7 (Medium) menurut redhat.com.

Deskripsi (NVD)

A flaw was found in SSSD. A local user can trigger a Denial of Service (DoS) by exploiting a race condition in the autofs responder between asynchronous enumeration completion and map invalidation. By repeatedly sending concurrent map enumeration and invalidation requests, an attacker can cause memory to leak, leading to excessive memory consumption that can disrupt or crash the autofs service.

Rincian

Terbit di NVD

6 Oktober 2026

Terakhir diubah

13 Oktober 2026

Status NVD

Analyzed

CVSS 3.1

4.7 (Medium), sumber redhat.com
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-772: Missing Release of Resource after Effective Lifetime

EPSS (30 hari)

0,10% peluang dieksploitasi; lebih tinggi dari 0,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://access.redhat.com/security/cve/CVE-2026-104045 advisory vendor
• https://bugzilla.redhat.com/show_bug.cgi?id=2478663 exploit · issue tracking · mitigasi · advisory vendor