CVE-2026-13757

MEDIUM

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Title source: cna

Description

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

References (5)

Core 5

Core References

Vdb Entry, X_Refsource_Redhat vdb-entry x_refsource_redhat

https://access.redhat.com/security/cve/CVE-2026-13757

Issue Tracking, X_Refsource_Redhat issue-tracking x_refsource_redhat

RHBZ#2494556

https://bugzilla.redhat.com/show_bug.cgi?id=2494556

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:37469

https://access.redhat.com/errata/RHSA-2026:37469

Vendor Advisory vendor-advisory x_refsource_redhat

RHSA-2026:38342

https://access.redhat.com/errata/RHSA-2026:38342

https://github.com/advisories/GHSA-p2wm-69qx-x25w

Scores

CVSS v3 6.2

EPSS 0.0014

EPSS Percentile 3.5%

Attack Vector LOCAL

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment

Exploitation none

Automatable no

Technical Impact partial

Details

CWE

CWE-674

Status published

Products (17)

p11-kit_project/p11-kit

Red Hat/Red Hat Enterprise Linux 10

Red Hat/Red Hat Enterprise Linux 6

Red Hat/Red Hat Enterprise Linux 7

Red Hat/Red Hat Enterprise Linux 8

Red Hat/Red Hat Enterprise Linux 9

Red Hat/Red Hat Hardened Images

Red Hat/Red Hat Hardened Images 0.26.2-1.2.hum1

Red Hat/Red Hat Hardened Images 0.26.4-1.hum1

Red Hat/Red Hat OpenShift Container Platform 4

... and 7 more

Published Jun 29, 2026

Tracked Since Jun 30, 2026