A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alma_linux | — | Upgrade p11-kit-develUpgrade p11-kit-serverUpgrade p11-kit-trustUpgrade p11-kitUpgrade p11-kit-client | May 27, 2026 | May 19, 2026 |
| Alpine Linux | — | Upgrade p11-kit | Jun 26, 2026 | Mar 26, 2026 |
| Redhat_linux | — | Upgrade p11-kit-trust-debuginfoUpgrade p11-kit-trustUpgrade p11-kit-serverUpgrade p11-kit-client-debuginfoUpgrade p11-kit-debuginfoUpgrade p11-kit-debugsourceUpgrade p11-kit-clientUpgrade p11-kitUpgrade p11-kit-server-debuginfoUpgrade p11-kit-devel | May 20, 2026 | Feb 6, 2026 |
| Rocky_linux | — | Upgrade p11-kit-develUpgrade p11-kit-debuginfoUpgrade p11-kit-trust-debuginfoUpgrade p11-kit-client-debuginfoUpgrade p11-kit-trustUpgrade p11-kit-clientUpgrade p11-kit-debugsourceUpgrade p11-kitUpgrade p11-kit-server-debuginfoUpgrade p11-kit-server | Jun 1, 2026 | May 28, 2026 |
| Suse | — | Upgrade p11-kit-serverUpgrade p11-kit-develUpgrade libp11-kit0Upgrade p11-kit-nss-trustUpgrade p11-kitUpgrade p11-kit-tools | Jul 17, 2026 | Jun 11, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub