CVE-2026-13757

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

State: Published
Severity: 6.2 Medium
Published: Jun 29, 2026
Updated: Oct 14, 2026
Reserved: Jun 29, 2026

Description

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Scores

CVSS	Score	Vector	Source
3.1	6.2 Medium	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	redhat

Weaknesses

CWE-674 Uncontrolled Recursion

Affected Products

Product	Versions
Red Hat Enterprise Linux 10Red Hat	0:0.26.4-1.el10_2 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:0.26.4-1.el9_8 and laterNot affected
Red Hat Enterprise Linux 9Red Hat	0:0.26.4-1.el9_8 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat	1791371080 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat	1791371069 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat	1791788287 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat	1791378395 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.17Red Hat	1791970484 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat	1791459707 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat	1791459711 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat	1791459759 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat	1789029076 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.18Red Hat	1791966259 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat	1790223279 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat	1790223719 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat	1790272426 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat	1790589998 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat	1790589912 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat	1790589914 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat	1790589855 and laterNot affected
Cert Manager support for Red Hat OpenShift release 1.20Red Hat	1790598593 and laterNot affected
Cost Management 4Red Hat	1790844333 and laterNot affected
Red Hat Discovery 2Red Hat	1786638573 and laterNot affected
Red Hat Discovery 2Red Hat	1786634825 and laterNot affected
Red Hat Hardened ImagesRed Hat	0.26.2-1.2.hum1 and laterNot affected
Red Hat Hardened ImagesRed Hat	0.26.4-1.hum1 and laterNot affected
Red Hat Insights proxy 1.5Red Hat	1786433656 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1786435241 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1786533457 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1786533449 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1786435483 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1786533529 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1787241211 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1787135742 and laterNot affected
Red Hat Update Infrastructure 5Red Hat	1787241260 and laterNot affected
Red Hat Enterprise Linux 6Red Hat
Red Hat Enterprise Linux 7Red Hat
Red Hat Enterprise Linux 8Red Hat
Red Hat OpenShift Container Platform 4Red Hat
Red Hat OpenShift Container Platform 4Red Hat

References

RHSA-2026:37469vendor-advisory
RHSA-2026:38342vendor-advisory
RHSA-2026:49667vendor-advisory
RHSA-2026:49668vendor-advisory
RHSA-2026:53371vendor-advisory
RHSA-2026:54387vendor-advisory
RHSA-2026:54760vendor-advisory
RHSA-2026:58981vendor-advisory
RHSA-2026:72394vendor-advisory
RHSA-2026:72395vendor-advisory
RHSA-2026:72399vendor-advisory
RHSA-2026:72470vendor-advisory
RHSA-2026:72475vendor-advisory
RHSA-2026:72476vendor-advisory
RHSA-2026:72502vendor-advisory
RHSA-2026:81201vendor-advisory
RHSA-2026:82304vendor-advisory
RHSA-2026:82322vendor-advisory
RHSA-2026:82336vendor-advisory
RHSA-2026:82347vendor-advisory
RHSA-2026:82354vendor-advisory
RHSA-2026:82372vendor-advisory
RHSA-2026:82857vendor-advisory
RHSA-2026:82888vendor-advisory
https://access.redhat.com/security/cve/CVE-2026-13757vdb-entry
RHBZ#2494556issue-tracking
https://github.com/advisories/GHSA-p2wm-69qx-x25w

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.