This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2026-104038 →

DEBIAN-CVE-2026-104038

A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier...

Original description

The description as published by the source.

A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to verify the presence of the extension before processing it, causing the process to crash during authentication or lookup operations.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 sssd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

Debian:13 sssd

[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}]

References

advisory security-tracker.debian.org