Live › vulnerability › CVE-2026-57914
Apache Kerby's ASN.1 parser can be made to overflow the stack by a deeply nested ASN.1 structure sent to a Kerby client or service. The result is a crash, which means a denial of service.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 21:57 UTC, 0h before NVD. All times on this page are UTC.
Java projects that pull in kerby-asn1 below 2.1.2 and parse ASN.1 data from untrusted sources, such as Kerberos traffic or certificates a client sends. Projects that do not use Kerby, or that only handle trusted ASN.1 input, can skip it.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| org.apache.kerby:kerby-asn1 | maven | < 2.1.2 | 2.1.2 |
org.apache.kerby:kerby-asn1 below 2.1.2, for example with mvn dependency:treekerby-asn1 in the Maven lock or dependency report of each service that handles ASN.1 or Kerberos inputorg.apache.kerby:kerby-asn1 moves to 2.1.2Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-57914")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.