CVE-2026-2100
EUVD-2026-1633626.03.2026, 21:17
A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| p11-kit_project | p11-kit | 𝑥 < 0.26.2 |
| redhat | cert-manager_operator | 1.17.0 ≤ 𝑥 < 1.17.2 |
| redhat | cert-manager_operator | 1.18.0 ≤ 𝑥 < 1.18.2 |
| redhat | cert-manager_operator | 1.20.0 ≤ 𝑥 < 1.20.1 |
| redhat | cost_management_metrics_operator | 4.0.0 ≤ 𝑥 < 4.4.1 |
| redhat | hardened_images | - |
| redhat | insights-proxy | 1.5.0 |
| redhat | update_infrastructure | 5.0 |
| redhat | enterprise_linux | 6.0 |
| redhat | enterprise_linux | 7.0 |
| redhat | enterprise_linux | 8.0 |
| redhat | enterprise_linux | 9.0 |
| redhat | enterprise_linux | 10.0 |
𝑥
= Vulnerable software versions
Debian Releases
Ubuntu Releases
Red Hat Enterprise Linux Releases
Common Weakness Enumeration
References