Bug#1141184: p11-kit: CVE-2026-13757

[Salvatore Bonaccorso]

Source: p11-kit
Version: 0.26.2-3
Severity: important
Tags: security upstream
X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>

Hi Andreas,

The following vulnerability was published for p11-kit.

Sorry for the wague report.

CVE-2026-13757[0]:
| A flaw was found in p11-kit. The RPC message attribute parsing
| functions p11_rpc_message_get_attribute() and
| p11_rpc_message_get_attribute_array_value() form a mutually-
| recursive call chain with no recursion depth limit when processing
| nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and
| CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with
| local access to the p11-kit RPC Unix domain socket can send a
| specially crafted request with deeply nested template attributes,
| causing stack exhaustion and crashing the p11-kit server process and
| its dependent services.

TTBOMK, so far the only reference is actually the bugzilla entry form
Red Hat. Is upstream aware of the issue, or is there actually an
upstream tracking of it?


If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2026-13757
    https://www.cve.org/CVERecord?id=CVE-2026-13757
[1] https://bugzilla.redhat.com/show_bug.cgi?id=2494556

Please adjust the affected versions in the BTS as needed.

Regards,
Salvatore