Independent & educational platform Not a government body. No link or affiliation with any government organisation. Made for learning only. Test only systems you own or are authorised to test. Become a Partner or Sponsor → Full disclaimer

CVE-2026-2100

high

A flaw was found in p11-kit.

Vendor / product: P11-kit Project — p11-kit

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

CVSS
7.5
7.5 (CVSS v3.1)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity source: NVD CVSS v3.1 (nvd@nist.gov)
Timeline (UTC)
Published: 2026-03-26 21:17
Modified: 2026-10-29 14:13
NVD status: Analyzed
Last synced 12 hours ago
Verified against the source API 2026-10-29 14:37 UTC
Exploitation
Not listed in CISA KEV (as of last catalog sync)
Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

p11-kit_project / p11-kit <0.26.2
redhat / cert-manager_operator ≥1.17.0 <1.17.2, ≥1.18.0 <1.18.2, ≥1.20.0 <1.20.1
redhat / cost_management_metrics_operator ≥4.0.0 <4.4.1
redhat / hardened_images all versions
redhat / insights-proxy 1.5.0
redhat / update_infrastructure 5.0
redhat / enterprise_linux 6.0, 7.0, 8.0, 9.0, 10.0

Weakness classification (CWE)

CWE-824

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://access.redhat.com/errata/RHSA-2026:18143
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:18599
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:21275
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:22634
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:27998
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:58981
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:7065
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:72502
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:82304
Vendor advisory: https://access.redhat.com/errata/RHSA-2026:82322
Patch / mitigation: https://github.com/p11-glue/p11-kit/pull/740

References

Data sources

NVD CVE API 2.0 — fetched 2026-10-29 14:37 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores