---
id: CVE-2026-68744
title: 'Sssd: sssd: nss responder uninitialized heap disclosure in initgroups reply'
summary: >-
  A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the
  NSS responder pre-allocates reply space for all group entries but does not
  shrink the packet when groups are skipped, causing uninitialized heap bytes to
  be tra…
severity: low
cvss: 3.3
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N'
cvssSource: cna
cwe:
  - CWE-908
vendor: Red Hat
product: sssd
affected:
  - sssd (all versions)
  - sssd
  - sssd (all versions)
  - sssd (all versions)
  - sssd (all versions)
  - openshift/ose-rhel-coreos-8 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
  - openshift/ose-rhel-coreos-9 (all versions)
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-08-04T14:19:33.655887Z'
published: '2026-08-04'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T19:37:31.138Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-68744'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-68744'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2509761'
    label: RHBZ#2509761
tags:
  - cve.org
epss: 0.00133
epssPercentile: 0.02841
ingestedAt: '2026-11-06T20:03:04.271Z'
---

## Overview

A flaw was found in SSSD. The sss_nss_protocol_fill_initgr() function in the NSS responder pre-allocates reply space for all group entries but does not shrink the packet when groups are skipped, causing uninitialized heap bytes to be transmitted to the client. A local attacker can exploit this to disclose cached directory data and heap layout information from the sssd_nss process.

## Affected

- `sssd (all versions)`
- `sssd`
- `sssd (all versions)`
- `sssd (all versions)`
- `sssd (all versions)`
- `openshift/ose-rhel-coreos-8 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`
- `openshift/ose-rhel-coreos-9 (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.