openSUSE 16: libp11-kit0 / p11-kit / p11-kit-devel / p11-kit-nss-trust / etc (openSUSE-SU-2026:22105-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:22105-1 advisory. - CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing bsc1269664. - CVE-2026-18938: integer overflow in RPC...

Security update for p11-kit (moderate)

openSUSE security update: security update for p11-kit ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22105-1 Rating: moderate References: bsc1269664 bsc1280702 Cross-References: CVE-2026-13757 CVE-2026-18938 CVSS scores: CVE-2026-13757 SUSE : 6.2...

OPENSUSE-SU-2026:22105-1 Security update for p11-kit

This update for p11-kit fixes the following issues: - CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing bsc1269664. - CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems bsc1280702...

SUSE-SU-2026:24193-1 Security update for p11-kit

This update for p11-kit fixes the following issues: - CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing bsc1269664. - CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems bsc1280702...

SUSE-SU-2026:24255-1 Security update for p11-kit

This update for p11-kit fixes the following issues: - CVE-2026-13757: Stack exhaustion via unbounded recursion in RPC attribute parsing bsc1269664. - CVE-2026-18938: integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems bsc1280702...

Rocky Linux 9 [CIQ] Security Update: p11-kit / p11-kit-client / p11-kit-client-debuginfo / etc (crlsa-2026_49667)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202649667 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from the C...

Rocky Linux 10.2 [CIQ] Security Update: p11-kit / p11-kit-client / p11-kit-client-debuginfo / etc (crlsa-2026_49668)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202649668 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from th...

MGASA-2026-0460 Updated p11-kit packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. CVE-2026-13757 Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. CVE-2026-18938...

Updated p11-kit packages fix security vulnerabilities

The updated packages fix security vulnerabilities: Stack exhaustion via unbounded recursion in rpc attribute parsing. CVE-2026-13757 Integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems. CVE-2026-18938...

CLSA-2026-1788374737 p11-kit: Fix of CVE-2026-13757

CVE-2026-13757: add a recursion depth limit to RPC attribute parsing, preventing stack exhaustion when a client sends deeply nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE or CKADERIVETEMPLATE attributes...

CLSA-2026-1788357425 p11-kit: Fix of CVE-2026-13757

CVE-2026-13757: fix stack exhaustion in RPC attribute parsing...

MiracleLinux 9 : p11-kit-0.26.4-1.el9_8 (AXSA:2026-1590:02)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1590:02 advisory. p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing CVE-2026-13757 Tenable has extracted the preceding description block directly from...

CVE-2026-18938 P11-kit: integer overflow in rpc attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems

A flaw was found in p11-kit. A local attacker, or one with equivalent access to a reachable RPC channel, could exploit an integer overflow vulnerability. By sending specially crafted messages, the attacker can cause the system to miscalculate memory allocation for nested attributes. This leads to...

RLSA-2026:49667 Moderate: p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides certificate anchors and black lists based on configuration files. Security Fixes: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing...

p11-kit security update

An update is available for p11-kit. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The p11-kit packages provide a mechanism to manage PKCS11 modules. The...

Moderate: Red Hat Security Advisory: p11-kit security update

An update for p11-kit is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from t...

RHEL 9 : p11-kit (RHSA-2026:49667)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:49667 advisory. The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides...

ALSA-2026:49667 Moderate: p11-kit security update

The p11-kit packages provide a mechanism to manage PKCS11 modules. The p11-kit-trust subpackage includes a PKCS11 trust module that provides certificate anchors and black lists based on configuration files. Security Fixes: p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing...

P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing

...

CVE-2026-13757

CVE-2026-13757 affects p11-kit. The RPC attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() can form a mutually-recursive call chain with no recursion depth limit when handling nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TE...