CVE-2026-127099 · Infrastructure
NO FIX YET
SSSD, the System Security Services Daemon, does not check RSA component sizes before copying them into fixed-size stack buffers when converting X.509 certificate keys to SSH keys. An attacker who can supply a certificate with oversized RSA components that passes the configured checks can crash the service and corrupt SSH responder memory.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Systems that run SSSD with the SSH responder and accept X.509 certificates for SSH key lookup are the ones to look at. The sources do not say which certificate checks are needed to reach the flaw, or which SSSD versions are affected. Hosts that do not use SSSD's SSH responder are likely unaffected.
Not affected if no-certificate-auth, no-ssh-responder
Who cares linux, self-hosted, ssh, sssd
sssd --version (or rpm -q sssd / dpkg -l sssd)./etc/sssd/sssd.conf (the ssh service in services).No fix yet, per the sources.
A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.