P11-kit: null dereference via c_derivekey with specific null parameters
Priority MEDIUM 41CWE-824Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 11 fixed, 1 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and Red Hat. Impact type from CWE-824 and the CVSS impact.
Summary
A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01311 70th percentileScored 2026-11-07
Fix Partial p11-kit (p11-glue): 0.26.2Red Hat: 15 advisoriesRed Hat: 11 fixed, 1 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| p11-glue | p11-kit | before 0.26.2 | 0.26.2 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 10 | — | 0.26.2-1.el10 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 0.26.2-1.el9 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 9 | — | 0.26.2-1.el9 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791371080 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791371069 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791788287 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.17 | — | 1791970484 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459707 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459711 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791459759 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1789029076 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.18 | — | 1791966259 | Patch available | CNA |
| Red Hat | Cert Manager support for Red Hat OpenShift release 1.20 | — | 1790598593 | Patch available | CNA |
| Red Hat | Cost Management 4 | — | 1780946239 | Patch available | CNA |
| Red Hat | Red Hat Hardened Images | — | 0.26.2-1.1.hum1 | Patch available | CNA |
| Red Hat | Red Hat Insights proxy 1.5 | — | 1780420428 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1779798159 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1779798164 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1779798165 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1779798222 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787241211 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787135742 | Patch available | CNA |
| Red Hat | Red Hat Update Infrastructure 5 | — | 1787241260 | Patch available | CNA |
| Red Hat | Red Hat Enterprise Linux 6 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 7 | — | — | Not affected | CNA |
| Red Hat | Red Hat Enterprise Linux 8 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | No fix listed | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
| Red Hat | Red Hat OpenShift Container Platform 4 | — | — | Not affected | CNA |
- p11-kit Vendorp11-glue Affected before 0.26.2 Fixed in 0.26.2 Patch available CNA
- Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 0.26.2-1.el10 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 0.26.2-1.el9 Patch available CNA
- Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 0.26.2-1.el9 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791371080 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791371069 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791788287 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.17 VendorRed Hat Affected — Fixed in 1791970484 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459707 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459711 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791459759 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1789029076 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.18 VendorRed Hat Affected — Fixed in 1791966259 Patch available CNA
- Cert Manager support for Red Hat OpenShift release 1.20 VendorRed Hat Affected — Fixed in 1790598593 Patch available CNA
- Cost Management 4 VendorRed Hat Affected — Fixed in 1780946239 Patch available CNA
- Red Hat Hardened Images VendorRed Hat Affected — Fixed in 0.26.2-1.1.hum1 Patch available CNA
- Red Hat Insights proxy 1.5 VendorRed Hat Affected — Fixed in 1780420428 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1779798159 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1779798164 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1779798165 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1779798222 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787241211 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787135742 Patch available CNA
- Red Hat Update Infrastructure 5 VendorRed Hat Affected — Fixed in 1787241260 Patch available CNA
- Red Hat Enterprise Linux 6 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 7 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — No fix listed CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
- Red Hat OpenShift Container Platform 4 VendorRed Hat Affected — Fixed in — Not affected CNA
CPE configurations NVD · 11
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:p11-kit_project:p11-kit:*:*:*:*:*:*:*:* | before 0.26.2 | Vulnerable | P11-kit Project |
| cpe:2.3:a:redhat:cert-manager_operator:*:*:*:*:*:openshift:*:* | 1.17.0 to before 1.17.2; 1.18.0 to before 1.18.2; 1.20.0 to before 1.20.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:cost_management_metrics_operator:*:*:*:*:*:openshift:*:* | 4.0.0 to before 4.4.1 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:insights-proxy:1.5.0:*:*:*:*:*:*:* | 1.5.0 | Vulnerable | Red Hat |
| cpe:2.3:a:redhat:update_infrastructure:5.0:*:*:*:*:*:*:* | 5.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* | 8.0 | Vulnerable | Red Hat |
| cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Red Hat |
- cpe:2.3:a:p11-kit_project:p11-kit:*:*:*:*:*:*:*:* Versions before 0.26.2 Vulnerable ·P11-kit Project
- cpe:2.3:a:redhat:cert-manager_operator:*:*:*:*:*:openshift:*:* Versions 1.17.0 to before 1.17.2; 1.18.0 to before 1.18.2; 1.20.0 to before 1.20.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:cost_management_metrics_operator:*:*:*:*:*:openshift:*:* Versions 4.0.0 to before 4.4.1 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:hardened_images:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Red Hat
- cpe:2.3:a:redhat:insights-proxy:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Red Hat
- cpe:2.3:a:redhat:update_infrastructure:5.0:*:*:*:*:*:*:* Versions 5.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:* Versions 8.0 Vulnerable ·Red Hat
- cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Red Hat
Remediation
- Fix · CNA p11-kit (p11-glue) Fixed in 0.26.2
Red Hat 15 advisories
- RHSA-2026:82888 Released 2026-10-14 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-bundle
- RHSA-2026:82857 Released 2026-10-14 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-bundle
- RHSA-2026:82372 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
Show 12 more Red Hat advisories
- RHSA-2026:82354 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
- RHSA-2026:82347 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.18.2
- Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
- RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.17.2
- Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
- RHSA-2026:72502 Released 2026-09-28 · Red Hat rating Importantcert-manager Operator for Red Hat OpenShift 1.20.1
- Cert Manager support for Red Hat OpenShift release 1.20 registry.redhat.io/cert-manager/cert-manager-trust-manager-rhel9
- RHSA-2026:58981 Released 2026-08-24 · Red Hat rating CriticalRed Hat Update Infrastructure 5.3 Technology Preview security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-kubernetes-tp-rhel9, registry.redhat.io/rhui5/installer-tp-rhel9, registry.redhat.io/rhui5/rhua-tp-rhel9
- RHSA-2026:27998 Released 2026-06-22 · Red Hat rating ImportantCost Management Metrics Operator Update
- Cost Management 4 registry.redhat.io/costmanagement/costmanagement-metrics-rhel9-operator
- RHSA-2026:22634 Released 2026-06-02 · Red Hat rating ImportantInsights proxy Container Image
- Red Hat Insights proxy 1.5 registry.redhat.io/insights-proxy/insights-proxy-container-rhel9
- RHSA-2026:21275 Released 2026-05-27 · Red Hat rating CriticalRed Hat Update Infrastructure 5.1 security update
- Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
- RHSA-2026:18599 Released 2026-05-19 · Red Hat rating Moderatep11-kit security update
- Red Hat Enterprise Linux AppStream (v. 9) p11-kit-devel-0.26.2-1.el9, p11-kit-server-0.26.2-1.el9
- Red Hat Enterprise Linux BaseOS (v. 9) p11-kit-0.26.2-1.el9, p11-kit-client-0.26.2-1.el9, p11-kit-trust-0.26.2-1.el9
- RHSA-2026:18143 Released 2026-05-19 · Red Hat rating Moderatep11-kit security update
- Red Hat Enterprise Linux AppStream (v. 10) p11-kit-devel-0.26.2-1.el10, p11-kit-server-0.26.2-1.el10
- Red Hat Enterprise Linux BaseOS (v. 10) p11-kit-0.26.2-1.el10, p11-kit-client-0.26.2-1.el10, p11-kit-trust-0.26.2-1.el10
- RHSA-2026:7065 Released 2026-04-08 · Red Hat rating ModerateRed Hat Hardened Images RPMs bug fix and enhancement update
- Red Hat Hardened Images mingw32-p11-kit-0.26.2-1.1.hum1@noarch@public-hummingbird-aarch64-rpms, mingw32-p11-kit-0.26.2-1.1.hum1@noarch@public-hummingbird-x86_64-rpms, mingw64-p11-kit-0.26.2-1.1.hum1@noarch@public-hummingbird-aarch64-rpms +12
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | — |
| Cert Manager support for Red Hat OpenShift release 1.17 | Fixed | RHSA-2026:82304, RHSA-2026:82322, RHSA-2026:82888 |
| Cert Manager support for Red Hat OpenShift release 1.18 | Fixed | RHSA-2026:82347, RHSA-2026:82354, RHSA-2026:82372, RHSA-2026:82857 |
| Cert Manager support for Red Hat OpenShift release 1.20 | Fixed | RHSA-2026:72502 |
| Cost Management 4 | Fixed | RHSA-2026:27998 |
| Red Hat Enterprise Linux AppStream (v. 10) | Fixed | RHSA-2026:18143 |
| Red Hat Enterprise Linux AppStream (v. 9) | Fixed | RHSA-2026:18599 |
| Red Hat Enterprise Linux BaseOS (v. 10) | Fixed | RHSA-2026:18143 |
| Red Hat Enterprise Linux BaseOS (v. 9) | Fixed | RHSA-2026:18599 |
| Red Hat Hardened Images | Fixed | RHSA-2026:7065 |
| Red Hat Insights proxy 1.5 | Fixed | RHSA-2026:22634 |
| Red Hat Update Infrastructure 5 | Fixed | RHSA-2026:21275, RHSA-2026:58981 |
Not affected: 6 products
- Cost Management 4
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4
- Red Hat Update Infrastructure 5
Timeline
- 2026-10-02 Threatist record created from CVE-2026-2100
- 2026-10-03 Alias added: GHSA-hq85-3f6c-jx84
- 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
- 2026-10-14 Fix available: cert-manager/cert-manager-istio-csr-rhel9@1791459759, cert-manager/cert-manager-operator-rhel9@1789029076, cert-manager/cert-manager-operator-rhel9@1791788287 +4 · CNA
- 2026-10-14 5 new references · CNA
- 2026-10-14 Fix available: RHSA-2026:82372 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82354 · Red Hat
- 2026-10-14 Fix available: RHSA-2026:82347 · Red Hat
- 2026-10-15 Fix available: RHSA-2026:82857 · Red Hat
- 2026-10-15 Fix available: RHSA-2026:82888 · Red Hat
- 2026-10-15 Fix available: cert-manager/cert-manager-operator-bundle@1791966259, cert-manager/cert-manager-operator-bundle@1791970484 · CNA
- 2026-10-15 2 new references · CNA
- 2026-10-16 Fix available: Cert Manager support for Red Hat OpenShift release 1.17, Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat
References
Advisory 17
More Red Hat Cert-manager Operator vulnerabilities
- TI-2026-41777 Glib: integer underflow in gio/gdbusintrospection.c via "g_dbus_node_info_new_for_xml" CVSS 3.1CRITICAL 9.1
Sources
- CVE-2026-2100 · CVE Program
- CVE-2026-2100 · NVD
- FIRST EPSS
- GHSA-hq85-3f6c-jx84 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-2100 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences