SUSE-SU-2026:5079-1: Security update for sssd

Published Nov 3, 2026
·
Updated

This update for sssd fixes the following issues:

- CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807). - CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read (bsc#1273922). - CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds reads (bsc#1273925). - CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory disclosure (bsc#1273924). - CVE-2026-90462: Fail-open in LDAP ppolicy access check allows continued authorization (bsc#1282584). - CVE-2026-90463: out-of-bounds read in the NSS service request parsers (bsc#1280360). - CVE-2026-90994: out-of-bounds read in PAM v1 parser (bsc#1280361). - CVE-2026-90995: NULL pointer dereference in PAM responder (bsc#1280362). - CVE-2026-90996: zero-length request body underflow in the NSS responder (bsc#1280363). - CVE-2026-92821: access control bypass due to premature LDAP access rule evaluation (bsc#1284326). - CVE-2026-104029: denial of service due to out-of-bounds read in autofs responder (bsc#1284314). - CVE-2026-104031: denial of service via memory exhaustion in autofs responder (bsc#1284316). - CVE-2026-104033: access control bypass due to improper LDAP shadow expiration check (bsc#1284318). - CVE-2026-104036: denial of service due to out-of-bounds write in NFS idmap plugin (bsc#1284321). - CVE-2026-104037: denial of service due to packet length underflow in autofs responder (bsc#1284322). - CVE-2026-104038: denial of service via missing SID extension in certificate mapping (bsc#1284323). - CVE-2026-104039: denial of service due to stale connection state reuse in PAM GSSAPI responder (bsc#1284324). - CVE-2026-104043: Denial of Service via undersized packet parsing in NSS responder (bsc#1284266). - CVE-2026-104045: denial of service via race condition in autofs responder (bsc#1284470).

Other sources

This update for sssd fixes the following issues: CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a use-after-free (bsc#1269807). CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read (bsc#1273922). CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds reads (bsc#1273925). CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory disclosure (bsc#1273924). CVE-2026-90462: Fail-open in LDAP ppolicy access check allows continued authorization (bsc#1282584). CVE-2026-90463: out-of-bounds read in the NSS service request parsers (bsc#1280360). CVE-2026-90994: out-of-bounds read in PAM v1 parser (bsc#1280361). CVE-2026-90995: NULL pointer dereference in PAM responder (bsc#1280362). CVE-2026-90996: zero-length request body underflow in the NSS responder (bsc#1280363). CVE-2026-92821: access control bypass due to premature LDAP access rule evaluation (bsc#1284326). CVE-2026-104029: denial of service due to out-of-bounds read in autofs responder (bsc#1284314). CVE-2026-104031: denial of service via memory exhaustion in autofs responder (bsc#1284316). CVE-2026-104033: access control bypass due to improper LDAP shadow expiration check (bsc#1284318). CVE-2026-104036: denial of service due to out-of-bounds write in NFS idmap plugin (bsc#1284321). CVE-2026-104037: denial of service due to packet length underflow in autofs responder (bsc#1284322). CVE-2026-104038: denial of service via missing SID extension in certificate mapping (bsc#1284323). CVE-2026-104039: denial of service due to stale connection state reuse in PAM GSSAPI responder (bsc#1284324). CVE-2026-104043: Denial of Service via undersized packet parsing in NSS responder (bsc#1284266). CVE-2026-104045: denial of service via race condition in autofs responder (bsc#1284470).

— SUSE

Affected Software

96 affected componentsFixes available
suse/sssd<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
All of the following
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6 (ppc64le x86_64)
Any of the following
suse/sssd-dbus<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-debugsource<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ldap-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-proxy<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-winbind-idmap<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-dbus-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-tools<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-winbind-idmap-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/python3-sssd-config<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-kcm-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-kcm<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-common-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ipa<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-proxy-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-tools-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ipa-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ldap<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ad<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-common<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/python3-sssd-config-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ad-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
All of the following
SUSE SUSE Linux Enterprise Server for SAP Applications 15 SP6 (x86_64)
Any of the following
suse/sssd<32bit-2.10.2-150600.3.58.1
32bit-2.10.2-150600.3.58.1
suse/sssd<32bit-debuginfo-2.10.2-150600.3.58.1
32bit-debuginfo-2.10.2-150600.3.58.1
All of the following
SUSE openSUSE Leap 15.6 (aarch64 i586 ppc64le s390x x86_64)
Any of the following
suse/sssd-dbus<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-debugsource<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ldap-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-proxy<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-winbind-idmap<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/libnfsidmap-sss-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-dbus-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-tools<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/python3-sss-murmur<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-winbind-idmap-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/python3-sssd-config<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-kcm-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-kcm<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/python3-sss-murmur-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-common-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ipa<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-proxy-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-tools-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ipa-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ldap<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/libnfsidmap-sss<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ad<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-common<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/python3-sssd-config-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ad-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
All of the following
SUSE openSUSE Leap 15.6 (x86_64)
Any of the following
suse/sssd<32bit-2.10.2-150600.3.58.1
32bit-2.10.2-150600.3.58.1
suse/sssd<32bit-debuginfo-2.10.2-150600.3.58.1
32bit-debuginfo-2.10.2-150600.3.58.1
All of the following
SUSE openSUSE Leap 15.6 (aarch64_ilp32)
Any of the following
suse/sssd<64bit-debuginfo-2.10.2-150600.3.58.1
64bit-debuginfo-2.10.2-150600.3.58.1
suse/sssd<64bit-2.10.2-150600.3.58.1
64bit-2.10.2-150600.3.58.1
All of the following
SUSE SUSE Linux Enterprise Server 15 SP6 LTSS (aarch64 ppc64le s390x x86_64)
Any of the following
suse/sssd-dbus<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-debugsource<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ldap-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-proxy<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-winbind-idmap<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-dbus-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-tools<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-winbind-idmap-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/python3-sssd-config<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-kcm-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-kcm<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-common-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ipa<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-proxy-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-tools-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ipa-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ldap<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ad<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5-common<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/python3-sssd-config-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-ad-debuginfo<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
suse/sssd-krb5<2.10.2-150600.3.58.1
2.10.2-150600.3.58.1
All of the following
SUSE SUSE Linux Enterprise Server 15 SP6 LTSS (x86_64)
Any of the following
suse/sssd<32bit-2.10.2-150600.3.58.1
32bit-2.10.2-150600.3.58.1
suse/sssd<32bit-debuginfo-2.10.2-150600.3.58.1
32bit-debuginfo-2.10.2-150600.3.58.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade suse/sssd to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  2. Upgrade

    Upgrade suse/sssd-dbus to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  3. Upgrade

    Upgrade suse/sssd-debugsource to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  4. Upgrade

    Upgrade suse/sssd-ldap-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  5. Upgrade

    Upgrade suse/sssd-proxy to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  6. Upgrade

    Upgrade suse/sssd-winbind-idmap to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  7. Upgrade

    Upgrade suse/sssd-dbus-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  8. Upgrade

    Upgrade suse/sssd-krb5-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  9. Upgrade

    Upgrade suse/sssd-tools to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  10. Upgrade

    Upgrade suse/sssd-winbind-idmap-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  11. Upgrade

    Upgrade suse/python3-sssd-config to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  12. Upgrade

    Upgrade suse/sssd-kcm-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  13. Upgrade

    Upgrade suse/sssd-kcm to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  14. Upgrade

    Upgrade suse/sssd-krb5-common-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  15. Upgrade

    Upgrade suse/sssd-ipa to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  16. Upgrade

    Upgrade suse/sssd-proxy-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  17. Upgrade

    Upgrade suse/sssd-tools-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  18. Upgrade

    Upgrade suse/sssd-ipa-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  19. Upgrade

    Upgrade suse/sssd-ldap to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  20. Upgrade

    Upgrade suse/sssd-ad to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  21. Upgrade

    Upgrade suse/sssd-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  22. Upgrade

    Upgrade suse/sssd-krb5-common to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  23. Upgrade

    Upgrade suse/python3-sssd-config-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  24. Upgrade

    Upgrade suse/sssd-ad-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  25. Upgrade

    Upgrade suse/sssd-krb5 to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  26. Upgrade

    Upgrade suse/sssd to a version that resolves this vulnerability.

    Fixed in 32bit-2.10.2-150600.3.58.1
  27. Upgrade

    Upgrade suse/sssd to a version that resolves this vulnerability.

    Fixed in 32bit-debuginfo-2.10.2-150600.3.58.1
  28. Upgrade

    Upgrade suse/libnfsidmap-sss-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  29. Upgrade

    Upgrade suse/python3-sss-murmur to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  30. Upgrade

    Upgrade suse/python3-sss-murmur-debuginfo to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  31. Upgrade

    Upgrade suse/libnfsidmap-sss to a version that resolves this vulnerability.

    Fixed in 2.10.2-150600.3.58.1
  32. Upgrade

    Upgrade suse/sssd to a version that resolves this vulnerability.

    Fixed in 64bit-debuginfo-2.10.2-150600.3.58.1
  33. Upgrade

    Upgrade suse/sssd to a version that resolves this vulnerability.

    Fixed in 64bit-2.10.2-150600.3.58.1
  34. Upgrade

    Upgrade sssd to a version that resolves this vulnerability.

    Patch SUSE-2026-5079
  35. Upgrade

    Upgrade sssd to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-SLES-15-SP6-LTSS-2026-5079
  36. Upgrade

    Upgrade sssd to a version that resolves this vulnerability.

    Patch SUSE-SLE-Product-SLES_SAP-15-SP6-2026-5079

Event History

Nov 3, 2026
Advisory Published
via OSV·08:22 AM
Data Sourced
via OSV·08:22 AM
DescriptionAffected Software
Advisory Published
via SUSE·08:22 AM
Data Sourced
via SUSE·08:22 AM
RemedyDescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

1

Which installed packages are included in this update?

The update covers sssd, sssd-dbus, sssd-debugsource, sssd-ldap-debuginfo, sssd-proxy, sssd-winbind-idmap, sssd-dbus-debuginfo, and sssd-krb5-debuginfo.

2

Which environments should prioritize this update for authorization-related issues?

Deployments using LDAP ppolicy access checks or LDAP access rules should prioritize it. The update fixes a fail-open LDAP ppolicy authorization issue and an access-control bypass caused by premature LDAP access-rule evaluation.

3

Which SSSD services are implicated by malformed-request handling issues?

The listed issues affect PAM responders and parsers, NSS responders and service-request parsers, and the autofs responder. Reported outcomes include use-after-free, out-of-bounds reads, a NULL pointer dereference, an underflow, and potential heap-memory disclosure.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203