Source: p11-kit Version: 0.26.2-3 Severity: important Tags: security upstream X-Debbugs-Cc: [email protected], Debian Security Team <[email protected]>
Hi Andreas, The following vulnerability was published for p11-kit. Sorry for the wague report. CVE-2026-13757[0]: | A flaw was found in p11-kit. The RPC message attribute parsing | functions p11_rpc_message_get_attribute() and | p11_rpc_message_get_attribute_array_value() form a mutually- | recursive call chain with no recursion depth limit when processing | nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and | CKA_DERIVE_TEMPLATE attributes. An unauthenticated attacker with | local access to the p11-kit RPC Unix domain socket can send a | specially crafted request with deeply nested template attributes, | causing stack exhaustion and crashing the p11-kit server process and | its dependent services. TTBOMK, so far the only reference is actually the bugzilla entry form Red Hat. Is upstream aware of the issue, or is there actually an upstream tracking of it? If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2026-13757 https://www.cve.org/CVERecord?id=CVE-2026-13757 [1] https://bugzilla.redhat.com/show_bug.cgi?id=2494556 Please adjust the affected versions in the BTS as needed. Regards, Salvatore
