Moderate Vulnerability in p11-kit Packages: Stack Exhaustion via Unbounded Recursion
Summary
ALSA-2026:49667: Moderate: p11-kit security update. Affects p11-kit versions < 0.26.4-1.el9_8. Fixed in 0.26.4-1.el9_8. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The p11-kit packages are essential for managing PKCS#11 modules, which are used for cryptographic operations in various applications. The p11-kit-trust subpackage specifically provides a PKCS#11 trust module that manages certificate anchors and blacklists based on configuration files. This functionality is critical for maintaining secure communications and data integrity in software that relies on cryptographic services.
Vulnerability Detail
The vulnerability identified as CVE-2026-13757 involves a stack exhaustion issue caused by unbounded recursion during RPC attribute parsing within the p11-kit package. This flaw can lead to denial of service (DoS) conditions, where the affected application may crash or become unresponsive due to excessive resource consumption. The vulnerability arises from improper handling of input data, allowing attackers to exploit the recursion mechanism and exhaust the stack space.
How To Fix
Minimum fixed version
0.26.4-1.el9_8
This is the first release that contains the fix.
sudo dnf update p11-kitTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can limit the input data processed by the p11-kit package to prevent triggering the recursion issue. However, this is not a permanent solution and updating the package is strongly advised.
Conclusion
The p11-kit security update addresses a critical vulnerability that could lead to stack exhaustion and denial of service. Users are strongly encouraged to update their packages to the latest version to ensure the security and stability of their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for p11-kit →
FAQ
CVE-2026-13757 is a vulnerability in the p11-kit package that allows for stack exhaustion due to unbounded recursion in RPC attribute parsing.
This vulnerability can lead to denial of service, causing applications that rely on p11-kit to crash or become unresponsive.
You should update to the patched version 0.26.4-1.el9_8 as soon as possible to mitigate the risk associated with this vulnerability.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application against this vulnerability using the Vulert playground at Vulert Scanner without needing to sign up.
Failure to address this vulnerability may result in application downtime, security breaches, and potential data loss due to denial of service attacks.
Related vulnerabilities
Recent vulnerabilities recorded for p11-kit.
