AZL-91743

See a problem?

Import Source

https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91743.json

JSON Data

https://api.osv.dev/v1/vulns/AZL-91743

Upstream

CVE-2026-13757

Published

2026-06-29T19:16:40Z

Modified

2026-09-03T05:27:10Z

Summary

CVE-2026-13757 affecting package p11-kit 0.25.0-1

Details

A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute() and p11rpcmessagegetattributearrayvalue() form a mutually-recursive call chain with no recursion depth limit when processing nested CKAWRAPTEMPLATE, CKAUNWRAPTEMPLATE, and CKADERIVETEMPLATE attributes. An unauthenticated attacker with local access to the p11-kit RPC Unix domain socket can send a specially crafted request with deeply nested template attributes, causing stack exhaustion and crashing the p11-kit server process and its dependent services.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-13757

Affected packages

Azure Linux:3 / p11-kit

Package

Name: p11-kit
Purl: pkg:rpm/azure-linux/p11-kit

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Last affected

0.25.0-1

Database specific

source

"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-91743.json"