CVE-2026-13757

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.

Security Fix(es):

• p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.

Security Fix(es):

• p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.

Security Fix(es):

• p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.

Security Fix(es):

• p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing (CVE-2026-13757)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

• CVE-2026-13757: fix stack exhaustion in RPC attribute parsing

• CVE-2026-13757: add a recursion depth limit to RPC attribute parsing, preventing stack exhaustion when a client sends deeply nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE or CKA_DERIVE_TEMPLATE attributes

The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. (CVE-2026-13757) Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. (CVE-2026-18938)

These are all security issues fixed in the libp11-kit0-0.26.5-1.1 package on the GA media of openSUSE Tumbleweed.

This update for p11-kit fixes the following issues:

• CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing (bsc#1269664).
• CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems (bsc#1280702).

Root has patched CVE-2026-13757 in the p11-kit package for Root:Debian:11. Multiple fixed versions available.

Root has patched CVE-2026-13757 in the p11-kit package for Root:Debian:12. Multiple fixed versions available.

Root has patched CVE-2026-13757 in the p11-kit package for Root:Debian:13. Multiple fixed versions available.

This update for p11-kit fixes the following issues:

• CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing (bsc#1269664).
• CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems (bsc#1280702).

This update for p11-kit fixes the following issues:

• CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing (bsc#1269664).
• CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems (bsc#1280702).

It was discovered that p11-kit incorrectly handled certain RPC messages. A local attacker could use this issue to cause p11-kit to crash, resulting in a denial of service. (CVE-2026-13757)

It was discovered that p11-kit incorrectly handled nested attribute decoding on 32-bit systems. A local attacker could use this issue to cause p11-kit to crash, resulting in a denial of service. (CVE-2026-18938)