# CVE-2026-104029: sssd: This update for sssd fixes the following issues:  - CVE-2026-12610: cancelled or completed PAM request while the asyn...

CVE-2026-104029 is fixed in sssd on 1 platform by SUSE-SU-2026:5079-1 (version 2.10.2-150600.3.58.1), released November 7, 2026. It is not reported as exploited. Patch Radar priority: Routine.

- Web page: https://patchblox.com/security/cve/CVE-2026-104029
- Priority: Routine
- CVSS: n/a
- EPSS: 0.0013
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Nov 3, 2026

## Description

This update for sssd fixes the following issues:  - CVE-2026-12610: cancelled or completed PAM request while the asynchronous child process is still running can lead to a   use-after-free (bsc#1269807). - CVE-2026-68742: unvalidated address lengths in NSS responder packet parsing can cause a heap out-of-bounds read   (bsc#1273922). - CVE-2026-68743: oversized length parameters in authentication requests can cause heap out-of-bounds reads   (bsc#1273925). - CVE-2026-68744: unshrunk packet allocations during group resolution can allow uninitialized heap memory disclosure   (bsc#1273924). - CVE-2026-90462: Fail-open in LDAP ppolicy access check allows continued authorization (bsc#1282584). - CVE-2026-90463: out-of-bounds read in the NSS service request parsers (bsc#1280360). - CVE-2026-90994: out-of-bounds read in PAM v1 parser (bsc#1280361). - CVE-2026-90995: NULL pointer dereference in PAM responder (bsc#1280362). - CVE-2026-90996: zero-length request body underflow in the NSS responder (bsc#1280363). - CVE-2026-92821: access control bypass due to premature LDAP access rule evaluation (bsc#1284326). - CVE-2026-104029: denial of service due to out-of-bounds read in autofs responder (bsc#1284314). - CVE-2026-104031: denial of service via memory exhaustion in autofs responder (bsc#1284316). - CVE-2026-104033: access control bypass due to improper LDAP shadow expiration check (bsc#1284318). - CVE-2026-104036: denial of service due to out-of-bounds write in NFS idmap plugin (bsc#1284321). - CVE-2026-104037: denial of service due to packet length underflow in autofs responder (bsc#1284322). - CVE-2026-104038: denial of service via missing SID extension in certificate mapping (bsc#1284323). - CVE-2026-104039: denial of service due to stale connection state reuse in PAM GSSAPI responder (bsc#1284324). - CVE-2026-104043: Denial of Service via undersized packet parsing in NSS responder (bsc#1284266). - CVE-2026-104045: denial of service via race condition in autofs responder (bsc#1284470).

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | sssd sles 15.6 | 2.10.2-150600.3.58.1 | [SUSE-SU-2026:5079-1](https://patchblox.com/security/data/fix/linux/suse-su-2026-5079-1.md) | Nov 7, 2026 |

---

Data as of 2026-11-09T01:18:40Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.