Advisory severityMedium6.2Red Hat Linux

Medium [CVE-2026-13757] Stack exhaustion via unbounded recursion in RPC attribute parsing

This medium-severity Red Hat Linux advisory covers CVE-2026-13757 affecting Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9, Cert Manager support for Red Hat OpenShift release 1.17.

Aggregated and source-linked by VulniPulse. Data sources, validation and limitations.

CVE-2026-13757 Source published Jun 23, 2026Source updated Jun 23, 2026

VulniPulse record published Jul 13, 2026Record updated Jul 13, 2026

CVE-2026-13757

Affected products & platforms

Red Hat LinuxRed Hat Enterprise Linux

Open source advisory

Summary

A flaw was found in p11-kit. The RPC message attribute parsing functions p11_rpc_message_get_attribute() and p11_rpc_message_get_attribute_array_value() form a mutually-recursive call chain with no recursion depth limit when processing nested CKA_WRAP_TEMPLATE, CKA_UNWRAP_TEMPLATE, and CKA_DERIVE_TEMPLATE attributes.

Red Hat severity: Moderate — CVSS 6.2 (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Weakness: CWE-674.

Affected Red Hat products: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 9; Cert Manager support for Red Hat OpenShift release 1.17; Cert Manager support for Red Hat OpenShift release 1.18; Cert Manager support for Red Hat OpenShift release 1.20; Cost Management 4; Red Hat Discovery 2; Red Hat Hardened Images; Red Hat Insights proxy 1.5; Red Hat Update Infrastructure 5; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat OpenShift Container Platform 4.

Red Hat fixing advisory: RHSA-2026:49668, RHSA-2026:49667, RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82336, RHSA-2026:82888, RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857, RHSA-2026:72394, RHSA-2026:72395, RHSA-2026:72399, RHSA-2026:72470, RHSA-2026:72475, RHSA-2026:72476, RHSA-2026:72502, RHSA-2026:81201, RHSA-2026:54760, RHSA-2026:37469.

Affected products named by the advisory: Red Hat package: p11-kit.

Is CVE-2026-13757 exploited?

No exploitation is reported in the sources VulniPulse tracks: CVE-2026-13757 is not in the CISA KEV catalog (checked Nov 9, 2026) and this advisory does not report exploitation. That is not proof the vulnerability cannot be exploited.

How do I fix CVE-2026-13757?

Upgrade to a fixed release named by Red Hat:

p11-kit-0:0.26.4-1.el10_2
p11-kit-0:0.26.4-1.el9_8
cert-manager/jetstack-cert-manager-acmesolver-rhel9:1791371080
cert-manager/jetstack-cert-manager-rhel9:1791371069
cert-manager/cert-manager-operator-rhel9:1791788287
cert-manager/cert-manager-istio-csr-rhel9:1791378395
cert-manager/cert-manager-operator-bundle:1791970484
cert-manager/jetstack-cert-manager-acmesolver-rhel9:1791459707
cert-manager/jetstack-cert-manager-rhel9:1791459711
cert-manager/cert-manager-istio-csr-rhel9:1791459759
cert-manager/cert-manager-operator-rhel9:1789029076
cert-manager/cert-manager-operator-bundle:1791966259

38 more fixed releases are listed below.

Confirm against the vendor advisory before you patch.

Affected versions

No affected-version range was extracted from the source record. The vendor advisory is authoritative. Check it before change work.

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Fixed versions

p11-kit-0:0.26.4-1.el10_2
p11-kit-0:0.26.4-1.el9_8
cert-manager/jetstack-cert-manager-acmesolver-rhel9:1791371080
cert-manager/jetstack-cert-manager-rhel9:1791371069
cert-manager/cert-manager-operator-rhel9:1791788287
cert-manager/cert-manager-istio-csr-rhel9:1791378395
cert-manager/cert-manager-operator-bundle:1791970484
cert-manager/jetstack-cert-manager-acmesolver-rhel9:1791459707
cert-manager/jetstack-cert-manager-rhel9:1791459711
cert-manager/cert-manager-istio-csr-rhel9:1791459759
cert-manager/cert-manager-operator-rhel9:1789029076
cert-manager/cert-manager-operator-bundle:1791966259
cert-manager/jetstack-cert-manager-rhel9:1790223279
cert-manager/cert-manager-istio-csr-rhel9:1790223719
cert-manager/cert-manager-operator-rhel9:1790272426
cert-manager/jetstack-cert-manager-acmesolver-rhel9:1790589998
cert-manager/jetstack-cert-manager-rhel9:1790589912
cert-manager/cert-manager-istio-csr-rhel9:1790589914
cert-manager/cert-manager-operator-rhel9:1790589855
cert-manager/cert-manager-trust-manager-rhel9:1790598593
costmanagement/costmanagement-metrics-rhel9-operator:1790844333
discovery/discovery-server-rhel9:1786638573
discovery/discovery-ui-rhel9:1786634825
p11-kit-main-0.26.2-1.2.hum1
p11-kit-main-0.26.4-1.hum1
insights-proxy/insights-proxy-container-rhel9:1786433656
rhui5/cds-kubernetes-rhel9:1786435241
rhui5/cds-rhel9:1786533457
rhui5/haproxy-rhel9:1786533449
rhui5/installer-rhel9:1786435483
rhui5/rhua-rhel9:1786533529
rhui5/cds-kubernetes-tp-rhel9:1787241211
rhui5/installer-tp-rhel9:1787135742
rhui5/rhua-tp-rhel9:1787241260
RHSA-2026:49668
RHSA-2026:49667
RHSA-2026:82304
RHSA-2026:82322
RHSA-2026:82336
RHSA-2026:82888
RHSA-2026:82347
RHSA-2026:82354
RHSA-2026:82372
RHSA-2026:82857
RHSA-2026:72394
RHSA-2026:72395
RHSA-2026:72399
RHSA-2026:72470
RHSA-2026:72475
RHSA-2026:72476

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Mitigation checklist

Recommended fix / mitigation

This CVE requires same-user access to the p11-kit RPC Unix domain socket (/run/user/<uid>/p11-kit/pkcs11-*). Any process running as the socket-owning user can trigger the crash without further authentication. If p11-kit is managed via systemd --user, ensure `Restart=on-failure` is set in the unit file so that a crash is automatically recovered without manual intervention. Red Hat recommends updating p11-kit to version 0.26.3 or later, which introduces a recursion depth limit in the RPC attribute parsing and fully addresses this flaw.

Official advisory · high-confidence parse· fetched 14 days ago·verify at source

Get an email when Red Hat RHEL & SELinux publishes the next one.

See Red Hat RHEL & SELinux's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).

Alert me about Red Hat RHEL & SELinux

All Red Hat Linux advisories

Sources

Official and corroborating records used to build this advisory.

Red Hat Security Data APIofficial
Official vendor source used to discover this advisory; it remains the authority for affected products and remediation. Discovered from the machine-readable feed https://access.redhat.com/hydra/rest/securitydata/cve.json; this link opens the Red Hat Linux advisory index instead of the raw feed document.
Red Hat Linux
Official vendor advisoryofficial
Official advisory page fetched and parsed; accepted detail fields are attributed to this page.
Red Hat Linux
CVE.org CNA affected-product recordCVE.org
Structured CNA affected[] data independently confirmed the affected product scope; native advisory content remains authoritative.
CVE Program

Cross-references

Validate CVE metadata against the authoritative registries.

CVE-2026-13757NVD CVE.org MITRE

Free weekly CVE digest

Every Monday: the week's critical and high advisories for Red Hat or every vendor, new CISA KEV entries and upcoming end-of-life dates.

iPhone and Android apps · New on the App Store

Monitor future Red Hat Linux CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Get CVE alerts on Android See app features

Discussion(0)

No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.

Medium [CVE-2026-13757] Stack exhaustion via unbounded recursion in RPC attribute parsing

Summary

Is CVE-2026-13757 exploited?

How do I fix CVE-2026-13757?

Affected versions

Mitigation checklist

Get an email when Red Hat RHEL & SELinux publishes the next one.

More Red Hat Linux advisories

Monitor future Red Hat Linux CVEs from your phone.

Discussion(0)