Medium 5.5

A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request...

CVE-2026-127101 First seen on SecPulse 02:55

Original description The description as published by the source.

A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service.

Source: CVE.org (CVE Program・cvelistV5) NVD GitHub Advisory

References

Key facts

CVSS v3: Medium 5.5; CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Published: Nov 13, 2026
First seen on SecPulse: 02:55
GHSA: GHSA-9jhh-xxq5-xmxj
CWE: CWE-476

NVD GitHub Advisory

Tags(click for explanation)

Attack Types

Denial of Service

CWE

CWE-476

Vendors

Red Hat

All

Red Hat Enterprise Linux 10 Red Hat Enterprise Linux 6 Red Hat Enterprise Linux 7 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 9 Red Hat Openshift Container Platform 4 Red Hat Openshift Container Platform 5

Operating Systems

RHEL

Detection sources

NIST National Vulnerability Database03:17
GitHub Security Advisories (Global)03:32
Red Hat Security Advisories09:50
CVE.org (CVE Program・cvelistV5)02:55