Stack Exhaustion in p11-kit via Nested CKA Template Recursion
CVE-2026-13757 Published on June 29, 2026

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory Vendor Advisory NVD

Vulnerability Analysis

CVE-2026-13757 can be exploited with local system access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a high impact on availability.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
NONE
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
NONE
Integrity Impact:
NONE
Availability Impact:
HIGH

Timeline

Reported to Red Hat.

Made public.

Weakness Type

What is a Stack Exhaustion Vulnerability?

The product does not properly control the amount of recursion which takes place, consuming excessive resources, such as allocated memory or the program stack.

CVE-2026-13757 has been classified to as a Stack Exhaustion vulnerability or weakness.


Products Associated with CVE-2026-13757

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-13757 are published in these products:

Red Hat Enterprise Linux (RHEL)
 
Red Hat Hummingbird
 
Red Hat Openshift
 
Red Hat Insights Proxy
 
Red Hat Rhui
 
Red Hat Discovery
 
Canonical Ubuntu Linux
 
Red Hat Cert Manager
 
Red Hat Cost Management
 

Affected Versions

Red Hat Enterprise Linux 10: Red Hat Enterprise Linux 9: Red Hat Enterprise Linux 9: Cert Manager support for Red Hat OpenShift release 1.20: Cert Manager support for Red Hat OpenShift release 1.20: Cert Manager support for Red Hat OpenShift release 1.20: Cert Manager support for Red Hat OpenShift release 1.20: Cert Manager support for Red Hat OpenShift release 1.20: Cert Manager support for Red Hat OpenShift release 1.20: Cert Manager support for Red Hat OpenShift release 1.20: Cert Manager support for Red Hat OpenShift release 1.20: Red Hat Cost Management 4: Red Hat Discovery 2: Red Hat Discovery 2: Red Hat Hardened Images: Red Hat Hardened Images: Red Hat Insights proxy 1.5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Update Infrastructure 5: Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7: Red Hat Enterprise Linux 8: Red Hat OpenShift Container Platform 4: Red Hat OpenShift Container Platform 4:

Exploit Probability

EPSS
0.20%
Percentile
8.21%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.