CVE-2026-13757

The record

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

Affected packages

Related vulnerabilities

• CVE-2026-92822 A flaw was found in libmodulemd. CWE-674
• CVE-2026-112895 Pillow is a Python imaging library. CWE-674
• CVE-2026-100354 kin-openapi is a Go project for handling OpenAPI files. CWE-674
• CVE-2026-109267 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains a stack overflow in the MSL… CWE-674
• CVE-2026-109264 ImageMagick before 6.9.13-57 and 7.x before 7.1.2-32 contains uncontrolled recursion in… CWE-674
• CVE-2026-107678 FFmpeg through 9.0.2 contains a stack exhaustion vulnerability in… CWE-674
• CVE-2026-107208 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674
• CVE-2026-106572 ImageMagick is free and open-source software used for editing and manipulating digital… CWE-674