CVE-2026-88252 Sssd: sssd: denial of service via responder connection retry loop during file descriptor exhaustion
A local attacker can cause a denial of service in SSSD by exhausting file descriptors, triggering a CPU-intensive retry loop that stalls authentication services.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-88252?
CVE-2026-88252 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in sssd. A local user can cause a Denial of Service (DoS) by exhausting the responder service's available file descriptors (system handles used for open connections). By opening and maintaining many concurrent connections to a responder socket while continuing to queue new connection attempts, an attacker can trigger an unthrottled retry loop. This condition leads to high CPU utilization and stalls the service, preventing legitimate identity and authentication requests from being processed.
Weakness: CWE-835
Which versions are affected by CVE-2026-88252?
It affects 3 products.
Products include Fedoraproject Sssd, Redhat Enterprise Linux, Redhat Openshift Container Platform.
How do I fix CVE-2026-88252?
No fix has been published for CVE-2026-88252 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-88252 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-88252 exists.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as DEBIAN-CVE-2026-88252, GHSA-qj34-9w8c-jph5, UBUNTU-CVE-2026-88252.