Moderate Vulnerability in p11-kit: Stack Exhaustion via Unbounded Recursion
Summary
ALSA-2026:49668: Moderate: p11-kit security update. Affects p11-kit versions < 0.26.4-1.el10_2. Fixed in 0.26.4-1.el10_2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The p11-kit package is a crucial component in managing PKCS#11 modules, which are used for cryptographic tokens such as hardware security modules and smart cards. The p11-kit-trust subpackage specifically provides a PKCS#11 trust module that manages certificate anchors and blacklists based on configuration files. This functionality is essential for ensuring secure communications and data integrity in applications that rely on cryptographic operations.
Vulnerability Detail
The vulnerability identified as CVE-2026-13757 in the p11-kit package is a stack exhaustion issue caused by unbounded recursion during RPC attribute parsing. This flaw can lead to a denial of service (DoS) condition, where the application may crash or become unresponsive due to excessive resource consumption. Attackers could exploit this vulnerability by sending specially crafted requests that trigger the recursive parsing, potentially impacting the availability of services relying on p11-kit.
How To Fix
Minimum fixed version
0.26.4-1.el10_2
This is the first release that contains the fix.
sudo dnf update p11-kitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the exposure of the p11-kit service to untrusted networks or clients until the package is updated. Additionally, monitoring logs for unusual activity may help identify potential exploitation attempts.
Conclusion
The p11-kit package has a moderate vulnerability (CVE-2026-13757) that can lead to stack exhaustion and denial of service. Users are advised to update to the latest patched version to mitigate risks. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for p11-kit →
FAQ
CVE-2026-13757 is a vulnerability in the p11-kit package that allows for stack exhaustion due to unbounded recursion in RPC attribute parsing.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
The primary consequence is a denial of service (DoS) condition, where the application may crash or become unresponsive, affecting the availability of services that depend on p11-kit.
Yes, a patch is available in version 0.26.4-1.el10_2 of the p11-kit package. Users should update to this version or later.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json. It helps developers maintain secure applications.
Related vulnerabilities
Recent vulnerabilities recorded for p11-kit.
