--- id: CVE-2026-13757 title: A flaw was found in p11-kit summary: >- A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing n… severity: medium cvss: 6.2 cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H' cwe: - CWE-674 vendor: redhat product: hardened_images affected: - hardened_images - 'openshift_container_platform >= 4.0, <= 4.22.1' - enterprise_linux = 6.0 - enterprise_linux = 7.0 - enterprise_linux = 8.0 - enterprise_linux = 9.0 - enterprise_linux = 10.0 - p11-kit patched: - enterprise_linux_appstream_v_10 - enterprise_linux_appstream_v_9 - enterprise_linux_baseos_v_10 - enterprise_linux_baseos_v_9 - cert_manager_support_for_red_hat_openshift_release 1.20 - discovery 2 - hardened_images - insights_proxy 1.5 - update_infrastructure 5 published: '2026-06-29' updated: '2026-10-14' sourceUpdated: '2026-10-14T20:17:32.733' source: NVD sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13757' references: - url: 'https://access.redhat.com/errata/RHSA-2026:37469' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:38342' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:49667' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:49668' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:53371' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54387' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:54760' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:58981' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:72394' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:72395' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:72399' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:72470' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:72475' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:72476' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:72502' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:81201' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:82304' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:82322' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:82336' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:82347' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:82354' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:82372' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:82857' label: secalert@redhat.com - url: 'https://access.redhat.com/errata/RHSA-2026:82888' label: secalert@redhat.com - url: 'https://access.redhat.com/security/cve/CVE-2026-13757' label: secalert@redhat.com - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2494556' label: secalert@redhat.com - url: 'https://github.com/advisories/GHSA-p2wm-69qx-x25w' label: secalert@redhat.com - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13757.json - url: 'https://www.cve.org/CVERecord?id=CVE-2026-13757' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-13757' tags: - nvd - cve.org - csaf - vex - red-hat epss: 0.00154 epssPercentile: 0.04446 ssvc: exploitation: none automatable: 'no' technicalImpact: partial timestamp: '2026-07-01T14:21:14.619672Z' ingestedAt: '2026-07-11T20:15:25.597Z' --- ## Overview A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services. ## Affected - `hardened_images` - `openshift_container_platform >= 4.0, <= 4.22.1` - `enterprise_linux = 6.0` - `enterprise_linux = 7.0` - `enterprise_linux = 8.0` - `enterprise_linux = 9.0` - `enterprise_linux = 10.0` - `p11-kit` ## Remediation Refer to the linked advisories for vendor-supplied fixes and affected version ranges. ## Vendor advisories - **RHSA-2026:49668** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49668) - **RHSA-2026:49667** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9) · released 2026-08-03 · [advisory](https://access.redhat.com/errata/RHSA-2026:49667) - **RHSA-2026:72475** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72475) - **RHSA-2026:72395** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72395) - **RHSA-2026:72399** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72399) - **RHSA-2026:72476** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72476) - **RHSA-2026:72502** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72502) - **RHSA-2026:72470** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72470) - **RHSA-2026:72394** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.20 · released 2026-09-28 · [advisory](https://access.redhat.com/errata/RHSA-2026:72394) - **RHSA-2026:54760** · Red Hat · fixed in: Red Hat Discovery 2 · released 2026-08-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:54760) - **RHSA-2026:37469** · Red Hat · fixed in: Red Hat Hardened Images · released 2026-07-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:37469) - **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat OpenShift Container Platform 4 · updated 2026-10-14 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-13757.json) - **RHSA-2026:82336** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82336) - **RHSA-2026:82322** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82322) - **RHSA-2026:82304** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.17 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82304) - **RHSA-2026:82354** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82354) - **RHSA-2026:82372** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82372) - **RHSA-2026:82347** · Red Hat · fixed in: Cert Manager support for Red Hat OpenShift release 1.18 · released 2026-10-13 · [advisory](https://access.redhat.com/errata/RHSA-2026:82347)