CVE-2026-2100
5.3 MEDIUMA flaw was found in p11-kit
Published: 2026-03-26 · Last updated: 2026-06-02
Severity and scoring
- CVSS
- 5.3 MEDIUM
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
- CWE
- CWE-824
Affected products
| Vendor | Product |
|---|---|
| p11-kit_project | enterprise_linux, hardened_images, p11-kit |
| redhat | enterprise_linux, hardened_images, p11-kit |
Description
A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.
Source: NVD
References
- [NVD]https://nvd.nist.gov/vuln/detail/CVE-2026-2100
- [Other]https://access.redhat.com/errata/RHSA-2026:18143
- [Other]https://access.redhat.com/errata/RHSA-2026:18599
- [Other]https://access.redhat.com/errata/RHSA-2026:21275
- [Other]https://access.redhat.com/errata/RHSA-2026:22634
- [Other]https://access.redhat.com/errata/RHSA-2026:7065
- [Vendor advisory]https://access.redhat.com/security/cve/CVE-2026-2100
- [Vendor advisory]https://bugzilla.redhat.com/show_bug.cgi?id=2437308
- [Patch]https://github.com/p11-glue/p11-kit/pull/740
Related CVEs
Same vendor
- CVE-2026-50259 — A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland (7.8 HIGH)
- CVE-2026-50258 — A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland (7.8 HIGH)
- CVE-2026-50257 — A use-after-free flaw was found in the X.Org X server and Xwayland in miSyncDestroyFence() (7.8 HIGH)
- CVE-2026-50256 — A stack-based buffer overflow flaw was found in the X.Org X server and Xwayland (7.8 HIGH)
- CVE-2026-1784 — The Route OpenShift resource allows to define routes to make pods reachable at a subdomain through HAProxy (8.8 HIGH)
Same CWE
- CVE-2026-47908 — Dreamweaver Desktop versions 21.7 and earlier are affected by an Access of Uninitialized Pointer vulnerability that could result in arbit... (7.8 HIGH)
- CVE-2026-47320 — Access of uninitialized pointer, Uncontrolled Recursion vulnerability in Samsung Open Source rlottie allows Pointer Manipulation, Oversiz... (6.1 MEDIUM)
- CVE-2026-42959 — NLnet Labs Unbound up to and including version 1.25.0 has a denial of service vulnerability in the DNSSEC validator that can lead to a cr... (7.5 HIGH)
- CVE-2025-66588 — In AzeoTech DAQFactory release 20.7 (Build 2555), an access of uninitialized pointer vulnerability can be exploited by an attacker which ... (7.8 HIGH)