Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2026-13757

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Published
Last modified
published
Not listed in CISA KEV
None on Exploit-DB, Metasploit or GitHub
  • Exploitation: none
  • Automatable: no
  • Technical impact: partial

Summary

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: no · Technical impact: partial

  3. Record last updated

Affected versions

  • p11-kit

    Version range not reported

  • p11-kit

    Version range not reported

  • cert-manager/jetstack-cert-manager-acmesolver-rhel9

    Version range not reported

  • cert-manager/jetstack-cert-manager-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-rhel9

    Version range not reported

  • cert-manager/cert-manager-istio-csr-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-bundle

    Version range not reported

  • cert-manager/jetstack-cert-manager-acmesolver-rhel9

    Version range not reported

  • cert-manager/jetstack-cert-manager-rhel9

    Version range not reported

  • cert-manager/cert-manager-istio-csr-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-bundle

    Version range not reported

  • cert-manager/jetstack-cert-manager-rhel9

    Version range not reported

  • cert-manager/cert-manager-istio-csr-rhel9

    Version range not reported

  • cert-manager/cert-manager-operator-rhel9

    Version range not reported

  • cert-manager/jetstack-cert-manager-acmesolver-rhel9

    Version range not reported

  • cert-manager/cert-manager-trust-manager-rhel9

    Version range not reported

  • costmanagement/costmanagement-metrics-rhel9-operator

    Version range not reported

  • discovery/discovery-server-rhel9

    Version range not reported

  • discovery/discovery-ui-rhel9

    Version range not reported

  • p11-kit-main

    Version range not reported

  • insights-proxy/insights-proxy-container-rhel9

    Version range not reported

  • rhui5/cds-kubernetes-rhel9

    Version range not reported

  • rhui5/cds-rhel9

    Version range not reported

  • rhui5/haproxy-rhel9

    Version range not reported

  • rhui5/installer-rhel9

    Version range not reported

  • rhui5/rhua-rhel9

    Version range not reported

  • rhui5/cds-kubernetes-tp-rhel9

    Version range not reported

  • rhui5/installer-tp-rhel9

    Version range not reported

  • rhui5/rhua-tp-rhel9

    Version range not reported

  • p11-kit

    Version range not reported

  • p11-kit

    Version range not reported

  • p11-kit

    Version range not reported

  • openshift/ose-rhel-coreos-8

    Version range not reported

  • openshift/ose-rhel-coreos-9

    Version range not reported

References 25

access.redhat.com