Moderate Vulnerability in p11-kit: Stack Exhaustion via Unbounded Recursion
Summary
RLSA-2026:49667: Moderate: p11-kit security update. Affects p11-kit versions < 0:0.26.4-1.el9_8. Fixed in 0:0.26.4-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The p11-kit package is a crucial component for managing PKCS#11 modules, which are used for cryptographic tokens such as smart cards and hardware security modules. The p11-kit-trust subpackage specifically provides a PKCS#11 trust module that manages certificate anchors and blacklists based on configuration files. This functionality is essential for secure communications and data integrity in applications relying on cryptographic operations.
Vulnerability Detail
The vulnerability identified as CVE-2026-13757 in p11-kit is a stack exhaustion issue caused by unbounded recursion during RPC attribute parsing. This flaw can lead to a denial of service (DoS) condition, where the affected system may become unresponsive due to excessive resource consumption. Attackers could exploit this vulnerability to disrupt services that depend on p11-kit, potentially compromising the security and availability of applications utilizing PKCS#11 modules.
How To Fix
Minimum fixed version
0:0.26.4-1.el9_8
This is the first release that contains the fix.
sudo dnf update p11-kitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, no specific workarounds are provided for this vulnerability. It is advisable to apply the patch as soon as it is available to mitigate the risk.
Conclusion
The p11-kit package has a moderate vulnerability (CVE-2026-13757) that can lead to stack exhaustion and denial of service. It is crucial to update to the patched version to mitigate this risk. Regular monitoring and updates are essential for maintaining the security of applications relying on cryptographic modules.
See every vulnerability recorded for p11-kit →
FAQ
CVE-2026-13757 is a vulnerability in the p11-kit package that allows for stack exhaustion due to unbounded recursion in RPC attribute parsing.
The primary impact is a denial of service (DoS), where the affected system may become unresponsive, disrupting services that rely on p11-kit.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The CVSS score for this vulnerability is 6.2, indicating a moderate severity level.
Using tools like Vulert, which monitors and alerts for open-source vulnerabilities in real-time, can help you stay informed about potential risks in your software.
Related vulnerabilities
Recent vulnerabilities recorded for p11-kit.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
