ZeroDay Findings
Sign inSign up

Findings

CVE-2026-2100

A flaw was found in p11-kit.

Published Mar 26, 2026 · updated Oct 14, 2026 · p11-kit project p11-kit

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Timeline

Detection, updates, and resolution for this record.

  1. Mar 26, 2026 · NIST NVD

    Detected

    A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level de

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level de

  3. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level de

Affected

  • cpe p11-kit project/p11-kitversion unspecified
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux9.0
  • cpe redhat/hardened imagesversion unspecified

Sources

  • CVE.orgCVE-2026-2100

    Official CVE identifier

    cve.org
  • NIST NVDCVE-2026-2100

    A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialize

    nvd.nist.gov

References