{"id":"CVE-2026-127099","kind":"vulnerability","aliases":["CVE-2026-127099"],"related":[],"title":"SSSD: oversized RSA key in certificate can overflow stack buffer","description":"A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory.","summary":"SSSD, the System Security Services Daemon, does not check RSA component sizes before copying them into fixed-size stack buffers when converting X.509 certificate keys to SSH keys. An attacker who can supply a certificate with oversized RSA components that passes the configured checks can crash the service and corrupt SSH responder memory.","severity":"medium","cvss":5.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux","self-hosted","ssh","sssd"],"not_affected_if":["no-certificate-auth","no-ssh-responder"],"how_to_check":"- Check the installed SSSD version with `sssd --version` (or `rpm -q sssd` / `dpkg -l sssd`).\n- Check whether the SSH responder is enabled in `/etc/sssd/sssd.conf` (the `ssh` service in `services`).\n- Check whether certificate-based authentication is configured for SSSD.","fix":null,"status":"open","published_at":"2026-11-12T18:17:40+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","triaged_at":"2026-11-12T18:42:58+00:00","updated_at":"2026-11-12T18:42:58+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-12T18:42:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"SSSD: oversized RSA key in certificate can overflow stack buffer","impact":"medium","summary":"SSSD, the System Security Services Daemon, does not check RSA component sizes before copying them into fixed-size stack buffers when converting X.509 certificate keys to SSH keys. An attacker who can supply a certificate with oversized RSA components that passes the configured checks can crash the service and corrupt SSH responder memory.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sssd","linux","self-hosted","ssh"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Service crashes and SSH responder memory is corrupted","analyst_note":"Check the NVD entry and the SSSD upstream advisory for affected and fixed versions, and whether a non-default configuration is required.","how_to_check":"- Check the installed SSSD version with `sssd --version` (or `rpm -q sssd` / `dpkg -l sssd`).\n- Check whether the SSH responder is enabled in `/etc/sssd/sssd.conf` (the `ssh` service in `services`).\n- Check whether certificate-based authentication is configured for SSSD.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-ssh-responder","no-certificate-auth"],"who_is_affected":"Systems that run SSSD with the SSH responder and accept X.509 certificates for SSH key lookup are the ones to look at. The sources do not say which certificate checks are needed to reach the flaw, or which SSSD versions are affected. Hosts that do not use SSSD's SSH responder are likely unaffected.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000776,"input_tokens":4575,"output_tokens":637,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-127099':13A,16A '-2026':12A,15A 'abl':116C 'attack':54B,115C 'buffer':10A,44B,107C,112C 'caus':109C,132C 'certif':6A,48B,59B,88C,120C,129C 'check':32B,68B,97C,130C 'compon':34B,63B,101C,124C 'configur':67B,128C 'convers':85C 'convert':46B 'copi':37B,99C 'corrupt':74B,137C 'crash':70B 'cve':11A,14A 'daemon':29B 'denial':133C 'fix':41B,104C 'fixed-s':40B,103C 'flaw':79C 'found':81C 'host':21B 'infrastructur':17B 'key':4A,49B,52B,91C,94C 'linux':18B 'memori':77B,140C 'miss':95C 'overflow':8A,113C 'overs':2A,61B,122C 'pass':65B,126C 'public':90C 'respond':76B,139C 'rsa':3A,33B,62B,89C,100C,123C 'secur':27B 'self':20B 'self-host':19B 'servic':28B,72B,135C 'size':35B,42B,96C,105C 'ssh':22B,51B,75B,93C,138C 'sssd':1A,23B,24B,83C 'stack':9A,43B,106C,111C 'suppli':57B,118C 'system':26B 'x.509':47B,87C","nicknames":[],"mitigations":[],"who_affected":"Systems that run SSSD with the SSH responder and accept X.509 certificates for SSH key lookup are the ones to look at. The sources do not say which certificate checks are needed to reach the flaw, or which SSSD versions are affected. Hosts that do not use SSSD's SSH responder are likely unaffected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["infrastructure","linux","medium","selfhosted","ssh","sssd"],"campaign_type":null,"search_a":"'-127099':13A,16A '-2026':12A,15A 'buffer':10A 'certif':6A 'cve':11A,14A 'key':4A 'overflow':8A 'overs':2A 'rsa':3A 'sssd':1A 'stack':9A","search_b":"'attack':54B 'buffer':44B 'certif':48B,59B 'check':32B,68B 'compon':34B,63B 'configur':67B 'convert':46B 'copi':37B 'corrupt':74B 'crash':70B 'daemon':29B 'fix':41B 'fixed-s':40B 'host':21B 'infrastructur':17B 'key':49B,52B 'linux':18B 'memori':77B 'overs':61B 'pass':65B 'respond':76B 'rsa':33B,62B 'secur':27B 'self':20B 'self-host':19B 'servic':28B,72B 'size':35B,42B 'ssh':22B,51B,75B 'sssd':23B,24B 'stack':43B 'suppli':57B 'system':26B 'x.509':47B","search_c":"'abl':116C 'attack':115C 'buffer':107C,112C 'caus':109C,132C 'certif':88C,120C,129C 'check':97C,130C 'compon':101C,124C 'configur':128C 'convers':85C 'copi':99C 'corrupt':137C 'denial':133C 'fix':104C 'fixed-s':103C 'flaw':79C 'found':81C 'key':91C,94C 'memori':140C 'miss':95C 'overflow':113C 'overs':122C 'pass':126C 'public':90C 'respond':139C 'rsa':89C,100C,123C 'servic':135C 'size':96C,105C 'ssh':93C,138C 'sssd':83C 'stack':106C,111C 'suppli':118C 'x.509':87C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:40+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:H","cvss_by":"secalert@redhat.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-127099","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-127099","severity":null,"published_at":"2026-11-12T18:17:40+00:00","modified_at":"2026-11-12T18:17:40+00:00","first_seen_at":"2026-11-12T18:40:39+00:00","fetched_at":"2026-11-12T18:40:39+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}