Uncontrolled Recursion in p11-kit - CVE-2026-13757

Vulnerability identifier: #VU146636

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-13757

CWE-ID: CWE-674

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to uncontrolled recursion in the p11_rpc_message_get_attribute and p11_rpc_message_get_attribute_array_value functions when processing nested template attributes. A remote attacker can send a specially crafted request with deeply nested attributes via the RPC Unix domain socket to cause a denial of service.

Exploitation can lead to stack exhaustion and crash the server process.

p11-kit
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Ubuntu
Anolis OS
Fedora
IBM DataPower Gateway
p11-kit
p11-kit-devel
p11-kit-server
p11-kit-trust
p11-kit-doc
p11-kit (Red Hat package)
p11-kit (Ubuntu package)
Red Hat build of Keycloak

Install security update from vendor's website.

p11-kit - update to 0.26.3
IBM DataPower Gateway - update to 11.0.0.3
p11-kit - update to 0.25.0-2
p11-kit-devel - update to 0.25.0-2
p11-kit-server - update to 0.25.0-2
p11-kit-trust - update to 0.25.0-2
p11-kit-doc - update to 0.25.0-2
p11-kit (Red Hat package) - addressed in versions 0.26.4-1.el9_8, 0.26.4-1.el10_2
p11-kit - addressed in versions 0.26.4-1.fc43, 0.26.4-1.fc44
Red Hat build of Keycloak - update to 26.4.15
p11-kit (Ubuntu package) - addressed in versions 0.23.9-2ubuntu0.1+esm1, 0.23.20-1ubuntu0.1+esm1, 0.24.0-6ubuntu0.1, 0.25.3-4ubuntu2.2

• https://security.snyk.io/vuln/SNYK-UNMANAGED-P11GLUEP11KIT-17705236
• https://bugzilla.redhat.com/show_bug.cgi?id=2494556

• Denial of service in p11-kit
• Fedora 44 update for p11-kit
• Fedora 43 update for p11-kit
• Red Hat Enterprise Linux 9 update for p11-kit
• Red Hat Enterprise Linux 10 update for p11-kit
• Multiple vulnerabilities in Red Hat build of Keycloak 26.4
• Anolis OS update for p11-kit
• Ubuntu update for p11-kit
• Multiple vulnerabilities in IBM DataPower Gateway