CVEvulnerability

CVE-2026-2100

7.5 HIGH Published 2026-03-26 Modified 2026-10-29 Official page ↗
Status
Analyzed
Published
2026-03-26
Last modified
2026-10-29
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 3.1 ([email protected])
7.5 HIGH — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-824

Description

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Affected configurations

• p11-kit project p11-kit (< 0.26.2) • redhat cert-manager operator (>= 1.17.0 < 1.17.2) • redhat cert-manager operator (>= 1.18.0 < 1.18.2) • redhat cert-manager operator (>= 1.20.0 < 1.20.1) • redhat cost management metrics operator (>= 4.0.0 < 4.4.1) • redhat hardened images • redhat insights-proxy 1.5.0 • redhat update infrastructure 5.0 • redhat enterprise linux 6.0 • redhat enterprise linux 7.0 • redhat enterprise linux 8.0 • redhat enterprise linux 9.0 • redhat enterprise linux 10.0

Related

Weakness · CWE (1)

  • CWE-824 Access of Uninitialized Pointer weakness

References