CVE-2026-13757 P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
A local attacker can crash the p11-kit server and dependent services by sending deeply nested RPC attributes, causing stack exhaustion.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-13757?
CVE-2026-13757 is a medium-severity denial of service vulnerability in Redhat Enterprise Linux, published on 29 Jun 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.
Weakness: CWE-674
Which versions are affected by CVE-2026-13757?
It affects 4 products.
Linux distribution packages (40)
p11-kit AlmaLinux:10 | All versions | 0.26.4-1.el10_2 |
p11-kit-client AlmaLinux:10 | All versions | 0.26.4-1.el10_2 |
p11-kit-devel AlmaLinux:10 | All versions | 0.26.4-1.el10_2 |
p11-kit-server AlmaLinux:10 | All versions | 0.26.4-1.el10_2 |
p11-kit-trust AlmaLinux:10 | All versions | 0.26.4-1.el10_2 |
p11-kit AlmaLinux:9 | All versions | 0.26.4-1.el9_8 |
p11-kit-client AlmaLinux:9 | All versions | 0.26.4-1.el9_8 |
p11-kit-devel AlmaLinux:9 | All versions | 0.26.4-1.el9_8 |
p11-kit-server AlmaLinux:9 | All versions | 0.26.4-1.el9_8 |
p11-kit-trust AlmaLinux:9 | All versions | 0.26.4-1.el9_8 |
p11-kit Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-client Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-client-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-debugsource Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-devel Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-server Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-server-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-trust Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-trust-debuginfo Red Hat:enterprise_linux:10.2 | All versions | 0:0.26.4-1.el10_2 |
p11-kit-client-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.26.4-1.el9_8 |
p11-kit-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.26.4-1.el9_8 |
p11-kit-debugsource Red Hat:enterprise_linux:9::appstream | All versions | 0:0.26.4-1.el9_8 |
p11-kit-devel Red Hat:enterprise_linux:9::appstream | All versions | 0:0.26.4-1.el9_8 |
p11-kit-server Red Hat:enterprise_linux:9::appstream | All versions | 0:0.26.4-1.el9_8 |
p11-kit-server-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.26.4-1.el9_8 |
p11-kit-trust-debuginfo Red Hat:enterprise_linux:9::appstream | All versions | 0:0.26.4-1.el9_8 |
p11-kit Red Hat:enterprise_linux:9::baseos | All versions | 0:0.26.4-1.el9_8 |
p11-kit-client Red Hat:enterprise_linux:9::baseos | All versions | 0:0.26.4-1.el9_8 |
p11-kit-client-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:0.26.4-1.el9_8 |
p11-kit-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:0.26.4-1.el9_8 |
p11-kit-debugsource Red Hat:enterprise_linux:9::baseos | All versions | 0:0.26.4-1.el9_8 |
p11-kit-server-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:0.26.4-1.el9_8 |
p11-kit-trust Red Hat:enterprise_linux:9::baseos | All versions | 0:0.26.4-1.el9_8 |
p11-kit-trust-debuginfo Red Hat:enterprise_linux:9::baseos | All versions | 0:0.26.4-1.el9_8 |
mingw32-p11-kit Red Hat:hummingbird:1 | All versions | 0:0.26.2-1.2.hum1 |
mingw32-p11-kit Red Hat:hummingbird:1 | All versions | 0:0.26.4-1.hum1 |
mingw64-p11-kit Red Hat:hummingbird:1 | All versions | 0:0.26.2-1.2.hum1 |
mingw64-p11-kit Red Hat:hummingbird:1 | All versions | 0:0.26.4-1.hum1 |
p11-kit Red Hat:hummingbird:1 | All versions | 0:0.26.2-1.2.hum1 |
Products include P11-Kit Project P11-Kit, Redhat Enterprise Linux, Redhat Hardened Images, Redhat Openshift Container Platform.
How do I fix CVE-2026-13757?
Apply the vendor's patch.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-13757 being exploited?
There is no known exploitation of CVE-2026-13757 in the wild and no public exploit code.
Other vulnerabilities in Redhat Enterprise Linux
Sources
Also known as ALSA-2026:49667, ALSA-2026:49668, AZL-91743, BELL-CVE-2026-13757, CLSA-2026-1788357425, CLSA-2026-1788374737 and 13 more.