CVE-2026-104038

A flaw was found in sssd. A remote attacker can cause a denial of service (DoS) by submitting a certificate that lacks an expected Security Identifier (SID) extension. In deployments configured with SID-based certificate mapping rules, the service fails to verify the presence of the extension before processing it, causing the process to crash during authentication or lookup operations.

This vulnerability is rated as Moderate impact because triggering the denial of service requires an uncommon, non-default certificate mapping configuration. SSSD deployments are only susceptible if explicitly configured to use LDAPU1 mapping rules that expand SID or RID templates. Furthermore, an attacker must supply a certificate lacking the expected Microsoft SID extension to trigger the crash, confining the operational impact to certificate-driven lookup and authentication flows.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

A configuration-based workaround is available. Until a fix is shipped, avoid SSSD certificate mapping rules whose LDAPU1 maprule expands the {sid} or {sid.rid} templates (for example, 'maprule = LDAPU1:(objectsid={sid.rid})'). If SID-based mapping is required, reject certificates that lack the Microsoft SID extension (OID 1.3.6.1.4.1.311.25.2) before they reach the affected certificate mapping evaluation path, so SID-based rules fail cleanly instead of crashing the service.