boxscore/security
CVE · referencelatest edition

Reference page — cumulative record through Monday, October 19, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-2100

CVE-2026-2100HIGH
p11-glue p11-kit — P11-kit: null dereference via c_derivekey with specific null parameters
  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  N  N  H    7.5   .0126   69.2     —
AFFECTED
  Product                                                  Versions     Fixed
  p11-kit                                                  unspecified  —
  Red Hat Enterprise Linux 10                              unspecified  0:0.26.2-1.el10
  Red Hat Enterprise Linux 9                               unspecified  0:0.26.2-1.el9
  Red Hat Enterprise Linux 9                               unspecified  0:0.26.2-1.el9
  Cert Manager support for Red Hat OpenShift release 1.17  unspecified  1791371080
  Cert Manager support for Red Hat OpenShift release 1.17  unspecified  1791371069
  Cert Manager support for Red Hat OpenShift release 1.17  unspecified  1791788287
  Cert Manager support for Red Hat OpenShift release 1.17  unspecified  1791970484
  Cert Manager support for Red Hat OpenShift release 1.18  unspecified  1791459707
  Cert Manager support for Red Hat OpenShift release 1.18  unspecified  1791459711
  + 20 more
TIMELINE
  Feb 6   Reserved by redhat
  Mar 26  Published (CNA: redhat)
  Aug 17  RESCORED — CVE-2026-2100 (p11-glue p11-kit). CVSS 5.3 → 7.5 (NVD).
CWE-824 · CNA: redhat · CVSS v3.1 · 19 references · NVD status: Modified

Description

A flaw was found in p11-kit. A remote attacker could exploit this vulnerability by calling the C_DeriveKey function on a remote token with specific IBM kyber or IBM btc derive mechanism parameters set to NULL. This could lead to the RPC-client attempting to return an uninitialized value, potentially resulting in a NULL dereference or undefined behavior. This issue may cause an application level denial of service or other unpredictable system states.

Lifecycle

Complete event history — 3 events, chronological
DateEventDetail
February 6, 2026ReservedReserved by redhat
March 26, 2026PublishedPublished (CNA: redhat)
August 17, 2026RESCOREDRESCORED — CVE-2026-2100 (p11-glue p11-kit). CVSS 5.3 → 7.5 (NVD).

Affected

Affected products and packages — 30 rows
VendorProduct / PackageEcosystemVersion introducedFixed
p11-gluep11-kit———
Red HatRed Hat Enterprise Linux 10——0:0.26.2-1.el10
Red HatRed Hat Enterprise Linux 9——0:0.26.2-1.el9
Red HatRed Hat Enterprise Linux 9——0:0.26.2-1.el9
Red HatCert Manager support for Red Hat OpenShift release 1.17——1791371080
Red HatCert Manager support for Red Hat OpenShift release 1.17——1791371069
Red HatCert Manager support for Red Hat OpenShift release 1.17——1791788287
Red HatCert Manager support for Red Hat OpenShift release 1.17——1791970484
Red HatCert Manager support for Red Hat OpenShift release 1.18——1791459707
Red HatCert Manager support for Red Hat OpenShift release 1.18——1791459711
Red HatCert Manager support for Red Hat OpenShift release 1.18——1791459759
Red HatCert Manager support for Red Hat OpenShift release 1.18——1789029076
Red HatCert Manager support for Red Hat OpenShift release 1.18——1791966259
Red HatCert Manager support for Red Hat OpenShift release 1.20——1790598593
Red HatCost Management 4——1780946239
Red HatRed Hat Hardened Images——0.26.2-1.1.hum1
Red HatRed Hat Insights proxy 1.5——1780420428
Red HatRed Hat Update Infrastructure 5——1779798159
Red HatRed Hat Update Infrastructure 5——1779798164
Red HatRed Hat Update Infrastructure 5——1779798165
Red HatRed Hat Update Infrastructure 5——1779798222
Red HatRed Hat Update Infrastructure 5——1787241211
Red HatRed Hat Update Infrastructure 5——1787135742
Red HatRed Hat Update Infrastructure 5——1787241260
Red HatRed Hat Enterprise Linux 6———
Red HatRed Hat Enterprise Linux 7———
Red HatRed Hat Enterprise Linux 8———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———
Red HatRed Hat OpenShift Container Platform 4———

Weaknesses

CWE-824

References (19)

Related

Authoritative record: CVE-2026-2100 at cve.org

Vendors: p11-glue · red hat

Weaknesses: CWE-824

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-2100 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Monday, October 19, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.