CVE-2026-13757: P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute() and p11rpcmessagegetattributearrayvalue() form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.
Other sources
A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute() and p11rpcmessagegetattributearrayvalue() in p11-kit/rpc-message.c form a mutually-recursive call chain with no depth limit when processing CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attribute types. Similarly, protoreadattributebufferarray() in p11-kit/rpc-server.c recurses without bound for ISATTRIBUTEARRAY types.
An attacker who can connect to the p11-kit RPC server via Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-) can send a specially crafted CCreateObject request with deeply nested template attributes (~50,000 levels, ~650KB wire data), causing stack exhaustion and a SIGSEGV/SIGBUS crash of the p11-kit process. No authentication is required beyond same-user access to the Unix domain socket.
This results in denial of service for the p11-kit server and any dependent processes such as SSH agents, VPN clients, or web browsers using p11-kit for PKCS#11 module management. The recursive attribute support was introduced in commit 6529b540 (Feb 2024) without a depth bound.
— Red Hat
P11-kit: stack exhaustion via unbounded recursion in rpc attribute parsing
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.26.5-1 - Upgrade
Upgrade
debian/p11-kitto a version that resolves this vulnerability.Fixed in 0.26.5-1 - Upgrade
Upgrade
p11-kitto a version that resolves this vulnerability.Fixed in 27 August 2026 - Compensating control
Restrict access to the p11-kit RPC Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*) so that only the intended user/process can connect; same-user access is sufficient per the description, so enforce same-user-only permissions/ACL on the socket to prevent other local users from sending crafted requests.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-13757?
The severity of CVE-2026-13757 is medium with a score of 6.2.
How do I fix CVE-2026-13757?
To fix CVE-2026-13757, update to the latest version of p11-kit that contains the patch for this vulnerability.
What type of vulnerability is CVE-2026-13757?
CVE-2026-13757 is a flaw that involves stack exhaustion via unbounded recursion in RPC attribute parsing.
Who is affected by CVE-2026-13757?
CVE-2026-13757 affects systems running the p11-kit software that utilizes specific RPC message attribute parsing functions.
What are the potential impacts of CVE-2026-13757?
The potential impact of CVE-2026-13757 includes denial of service due to stack exhaustion.