Bug 2494556 (CVE-2026-13757)

Summary: CVE-2026-13757 p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security <prodsec-ir-bot>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, kshier, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, stcannon, suppawar, teagle, vlaad, watson-tool-maintainers, yguenane
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2494560    
Bug Blocks:    

Description OSIDB Bzimport 2026-06-29 17:50:03 UTC 
A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() in p11-kit/rpc-message.c form a mutually-recursive call chain with no depth limit when processing CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attribute types. Similarly, proto_read_attribute_buffer_array() in p11-kit/rpc-server.c recurses without bound for IS_ATTRIBUTE_ARRAY types.

An attacker who can connect to the p11-kit RPC server via Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*) can send a specially crafted C_CreateObject request with deeply nested template attributes (~50,000 levels, ~650KB wire data), causing stack exhaustion and a SIGSEGV/SIGBUS crash of the p11-kit process. No authentication is required beyond same-user access to the Unix domain socket.

This results in denial of service for the p11-kit server and any dependent processes such as SSH agents, VPN clients, or web browsers using p11-kit for PKCS#11 module management. The recursive attribute support was introduced in commit 6529b540 (Feb 2024) without a depth bound.
Comment 2 errata-xmlrpc 2026-08-03 13:21:47 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:49668 https://access.redhat.com/errata/RHSA-2026:49668
Comment 3 errata-xmlrpc 2026-08-03 13:45:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:49667 https://access.redhat.com/errata/RHSA-2026:49667