CVE-2026-13757

EUVD-2026-40173

29.06.2026, 19:16

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	6.2 MEDIUM	LOCAL	LOW	NONE	CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Base Score

CVSS 3.x

EPSS Score

Percentile: 8.19%

Affected Products (NVD)

Vendor	Product	Version
redhat	hardened_images	-
redhat	openshift_container_platform	4.0 ≤ 𝑥 ≤ 4.22.1
redhat	enterprise_linux	6.0
redhat	enterprise_linux	7.0
redhat	enterprise_linux	8.0
redhat	enterprise_linux	9.0
redhat	enterprise_linux	10.0
p11-kit_project	p11-kit	-

𝑥

= Vulnerable software versions

Debian Releases

Debian Product

Codename

p11-kit

bookworm	postponed
bullseye	postponed
forky	0.26.5-1 fixed
sid	0.26.5-1 fixed
trixie	no-dsa

Ubuntu Releases

Ubuntu Product

Codename

p11-kit

bionic	Fixed 0.23.9-2ubuntu0.1+esm1 released
focal	Fixed 0.23.20-1ubuntu0.1+esm1 released
jammy	Fixed 0.24.0-6ubuntu0.1 released
noble	Fixed 0.25.3-4ubuntu2.2 released
questing	ignored
resolute	needed
trusty	not-affected
xenial	not-affected