NetSight
IP …
medium5.3

CVE-2026-2100

A flaw was found in p11-kit.

Impact

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Affected products

VendorProductAffected versions
P11-Kit ProjectP11-Kit
before 0.26.2
RedhatCert-Manager Operator
from 1.17.0 before 1.17.2
from 1.18.0 before 1.18.2
from 1.20.0 before 1.20.1
RedhatCost Management Metrics Operator
from 4.0.0 before 4.4.1
RedhatHardened Images
All versions
RedhatInsights-Proxy
Version 1.5.0
RedhatUpdate Infrastructure
Version 5.0
RedhatEnterprise Linux
Versions 6.0, 7.0, 8.0, 9.0, 10.0

Weakness classification

CWE-824

References