{"id":"CVE-2026-13757","title":"A flaw was found in p11-kit","summary":"A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing n…","severity":"medium","cvss":6.2,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-674"],"vendor":"redhat","product":"hardened_images","affected":["hardened_images","openshift_container_platform >= 4.0, <= 4.22.1","enterprise_linux = 6.0","enterprise_linux = 7.0","enterprise_linux = 8.0","enterprise_linux = 9.0","enterprise_linux = 10.0","p11-kit"],"patched":["enterprise_linux_appstream_v_10","enterprise_linux_appstream_v_9","enterprise_linux_baseos_v_10","enterprise_linux_baseos_v_9","cert_manager_support_for_red_hat_openshift_release 1.20","discovery 2","hardened_images","insights_proxy 1.5","update_infrastructure 5"],"published":"2026-06-29","updated":"2026-10-14","sourceUpdated":"2026-10-14T20:17:32.733","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-13757","references":[{"url":"https://access.redhat.com/errata/RHSA-2026:37469","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:38342","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:49667","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:49668","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:53371","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:54387","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:54760","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:58981","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:72394","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:72395","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:72399","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:72470","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:72475","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:72476","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:72502","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:81201","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82304","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82322","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82336","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82347","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82354","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82372","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82857","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/errata/RHSA-2026:82888","label":"secalert@redhat.com"},{"url":"https://access.redhat.com/security/cve/CVE-2026-13757","label":"secalert@redhat.com"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2494556","label":"secalert@redhat.com"},{"url":"https://github.com/advisories/GHSA-p2wm-69qx-x25w","label":"secalert@redhat.com"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13757.json"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-13757"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-13757"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"epss":0.00154,"epssPercentile":0.04446,"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-01T14:21:14.619672Z"},"ingestedAt":"2026-07-11T20:15:25.597Z","slug":"CVE-2026-13757","body":"## Overview\n\nA flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.\n\n## Affected\n\n- `hardened_images`\n- `openshift_container_platform >= 4.0, <= 4.22.1`\n- `enterprise_linux = 6.0`\n- `enterprise_linux = 7.0`\n- `enterprise_linux = 8.0`\n- `enterprise_linux = 9.0`\n- `enterprise_linux = 10.0`\n- `p11-kit`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **RHSA-2026:49668** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49668)\n- **RHSA-2026:49667** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49667)\n- **RHSA-2026:72475** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72475)\n- **RHSA-2026:72395** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72395)\n- **RHSA-2026:72399** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72399)\n- **RHSA-2026:72476** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72476)\n- **RHSA-2026:72502** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72502)\n- **RHSA-2026:72470** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72470)\n- **RHSA-2026:72394** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72394)\n- **RHSA-2026:54760** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54760)\n- **RHSA-2026:37469** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:37469)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13757.json)\n- **RHSA-2026:82336** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82336)\n- **RHSA-2026:82322** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82322)\n- **RHSA-2026:82304** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82304)\n- **RHSA-2026:82354** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82354)\n- **RHSA-2026:82372** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82372)\n- **RHSA-2026:82347** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82347)","depth":"sunlit","depthScore":34,"depthScoreParts":{"impact":34.1,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}