# CVE-2026-13757: P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

Status: published. Published: 2026-06-29. Updated: 2026-11-06.

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

## Remediation

- workaround: This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication.

If p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention.

Red Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw. (source: CNA: redhat)

## Affected products and versions

- Red Hat / Red Hat Enterprise Linux 10 (p11-kit): ≥ 0:0.26.4-1.el10_2; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 9 (p11-kit): ≥ 0:0.26.4-1.el9_8; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.17 (cert-manager/jetstack-cert-manager-acmesolver-rhel9): ≥ 1791371080; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.17 (cert-manager/jetstack-cert-manager-rhel9): ≥ 1791371069; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.17 (cert-manager/cert-manager-operator-rhel9): ≥ 1791788287; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.17 (cert-manager/cert-manager-istio-csr-rhel9): ≥ 1791378395; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.17 (cert-manager/cert-manager-operator-bundle): ≥ 1791970484; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/jetstack-cert-manager-acmesolver-rhel9): ≥ 1791459707; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/jetstack-cert-manager-rhel9): ≥ 1791459711; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/cert-manager-istio-csr-rhel9): ≥ 1791459759; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/cert-manager-operator-rhel9): ≥ 1789029076; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.18 (cert-manager/cert-manager-operator-bundle): ≥ 1791966259; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/jetstack-cert-manager-rhel9): ≥ 1790223279; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/cert-manager-istio-csr-rhel9): ≥ 1790223719; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/cert-manager-operator-rhel9): ≥ 1790272426; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/jetstack-cert-manager-acmesolver-rhel9): ≥ 1790589998; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/jetstack-cert-manager-rhel9): ≥ 1790589912; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/cert-manager-istio-csr-rhel9): ≥ 1790589914; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/cert-manager-operator-rhel9): ≥ 1790589855; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cert Manager support for Red Hat OpenShift release 1.20 (cert-manager/cert-manager-trust-manager-rhel9): ≥ 1790598593; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Cost Management 4 (costmanagement/costmanagement-metrics-rhel9-operator): ≥ 1790844333; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Discovery 2 (discovery/discovery-server-rhel9): ≥ 1786638573; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Discovery 2 (discovery/discovery-ui-rhel9): ≥ 1786634825; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (p11-kit-main): ≥ 0.26.2-1.2.hum1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Hardened Images (p11-kit-main): ≥ 0.26.4-1.hum1; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Insights proxy 1.5 (insights-proxy/insights-proxy-container-rhel9): ≥ 1786433656; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/cds-kubernetes-rhel9): ≥ 1786435241; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/cds-rhel9): ≥ 1786533457; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/haproxy-rhel9): ≥ 1786533449; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/installer-rhel9): ≥ 1786435483; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/rhua-rhel9): ≥ 1786533529; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/cds-kubernetes-tp-rhel9): ≥ 1787241211; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/installer-tp-rhel9): ≥ 1787135742; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Update Infrastructure 5 (rhui5/rhua-tp-rhel9): ≥ 1787241260; < * (unaffected, rpm). Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 6 (p11-kit): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 7 (p11-kit): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat Enterprise Linux 8 (p11-kit): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift AI (RHOAI) (rhoai/odh-llama-stack-k8s-operator-rhel9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-8): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 4 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat
- Red Hat / Red Hat OpenShift Container Platform 5 (openshift/ose-rhel-coreos-9): Version range not reported. Source: CNA: redhat

## NVD configuration conditions

Affected CPE matches depend on the following AND/OR and negation conditions:

```json
[
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:redhat:openshift_container_platform:*:*:*:*:*:*:*:*",
            "versionEndIncluding": "4.22.1",
            "versionStartIncluding": "4.0",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  },
  {
    "negate": false,
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:p11-kit_project:p11-kit:-:*:*:*:*:*:*:*",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "OR"
  }
]
```

## Severity and prioritization

- CVSS 3.1: 6.2 (medium); CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: CNA: redhat

- CVSS 3.1: 6.2 (medium); CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H; source: NVD: secalert@redhat.com

- CISA KEV: No listing in collected sources

- EPSS: 0.15% as of 2026-11-05; percentile 4.53%

- SSVC: exploitation none; automatable no; technical impact partial; source ADP: CISA-ADP

- Weaknesses: CWE-674

## Exploit evidence

No exploit evidence in collected sources. This is not proof of no exploitation.

## References

- https://access.redhat.com/errata/RHSA-2026:37469 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:38342 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:49667 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:49668 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:53371 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:54387 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:54760 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:58981 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:72394 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:72395 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:72399 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:72470 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:72475 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:72476 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:72502 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:81201 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82304 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82322 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82336 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82347 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82354 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82372 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82857 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/errata/RHSA-2026:82888 (CNA: redhat; vendor-advisory, x_refsource_REDHAT)

- https://access.redhat.com/security/cve/CVE-2026-13757 (CNA: redhat; vdb-entry, x_refsource_REDHAT)

- https://bugzilla.redhat.com/show_bug.cgi?id=2494556 (CNA: redhat; issue-tracking, x_refsource_REDHAT)

- https://github.com/advisories/GHSA-p2wm-69qx-x25w (CNA: redhat)

- https://access.redhat.com/errata/RHSA-2026:37469 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:38342 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:49667 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:49668 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:53371 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:54387 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:54760 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:58981 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:72394 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:72395 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:72399 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:72470 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:72475 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:72476 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:72502 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:81201 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:82304 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:82322 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:82336 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:82347 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:82354 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:82372 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:82857 (secalert@redhat.com)

- https://access.redhat.com/errata/RHSA-2026:82888 (secalert@redhat.com)

- https://access.redhat.com/security/cve/CVE-2026-13757 (secalert@redhat.com; Vendor Advisory)

- https://bugzilla.redhat.com/show_bug.cgi?id=2494556 (secalert@redhat.com; Issue Tracking, Vendor Advisory)

- https://github.com/advisories/GHSA-p2wm-69qx-x25w (secalert@redhat.com)

## Provenance

- CNA: redhat: https://www.cve.org/CVERecord?id=CVE-2026-13757; retrieved 2026-11-06; source updated 2026-11-06

- NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-13757; retrieved 2026-11-05; source updated 2026-11-05

- FIRST EPSS: https://api.first.org/data/v1/epss?cve=CVE-2026-13757; retrieved 2026-11-05; source updated Not reported

Revision: a99de4d1ebcbf2b16749fc4304657a87de0f6b21495ee35ecb1d5915e0cd029d

Canonical: https://y2.dev/cve/CVE-2026-13757

## Agent and API access

Public CVE pages, Markdown, and JSON are free to read without an account or API key.

- Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end.

- WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers.

- Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}.

- Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer <Y2_API_KEY>. Setup: https://y2.dev/docs/api/create-key.

- x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402.

- OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json.

Collected public records only. Check source status for coverage and freshness.