{"id":"CVE-2026-57914","kind":"vulnerability","aliases":["CVE-2026-57914","GHSA-x6vc-x4v4-hjhr"],"related":[],"title":"Apache Kerby vulnerable to denial of service","description":"By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.","summary":"Apache Kerby's ASN.1 parser can be made to overflow the stack by a deeply nested ASN.1 structure sent to a Kerby client or service. The result is a crash, which means a denial of service.","severity":"medium","cvss":6.5,"epss":0.00436,"exploited":false,"exploited_at":null,"products":[{"name":"org.apache.kerby:kerby-asn1","fixed":["2.1.2"],"affected":"< 2.1.2","ecosystem":"maven"}],"ecosystems":["maven"],"tags":["cwe-400","java","kerberos","kerby","maven","package"],"not_affected_if":["kerby-asn1-not-used","trusted-input-only"],"how_to_check":"- Check whether the project depends on `org.apache.kerby:kerby-asn1` below `2.1.2`, for example with `mvn dependency:tree`\n- Look for `kerby-asn1` in the Maven lock or dependency report of each service that handles ASN.1 or Kerberos input","fix":"- `org.apache.kerby:kerby-asn1` moves to `2.1.2`","status":"open","published_at":"2026-06-26T12:16:33+00:00","first_seen_at":"2026-11-03T21:57:18+00:00","triaged_at":"2026-11-03T21:57:29+00:00","updated_at":"2026-11-03T22:07:19+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-11-03T21:57:29Z","model":"claude-haiku-5-5","output":{"fix":"- `org.apache.kerby:kerby-asn1` moves to `2.1.2`","reach":"network","title":"Apache Kerby: deeply nested ASN.1 input crashes client or service","impact":"low","summary":"Apache Kerby's ASN.1 parser can be made to overflow the stack by a deeply nested ASN.1 structure sent to a Kerby client or service. The result is a crash, which means a denial of service.","audience":"developers","category":"package","nicknames":[],"who_cares":["java","maven","kerberos","kerby"],"confidence":0.8,"fix_status":"available","needs_auth":"unknown","worst_case":"Stack overflow crashes the process, causing denial of service.","analyst_note":"","how_to_check":"- Check whether the project depends on `org.apache.kerby:kerby-asn1` below `2.1.2`, for example with `mvn dependency:tree`\n- Look for `kerby-asn1` in the Maven lock or dependency report of each service that handles ASN.1 or Kerberos input","plain_action":"","needs_analyst":false,"not_affected_if":["kerby-asn1-not-used","trusted-input-only"],"who_is_affected":"Java projects that pull in kerby-asn1 below 2.1.2 and parse ASN.1 data from untrusted sources, such as Kerberos traffic or certificates a client sends. Projects that do not use Kerby, or that only handle trusted ASN.1 input, can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000693,"input_tokens":4187,"output_tokens":548,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-2026':9A,17A '-400':24B '-57914':10A,18A '2.1.2':103C 'apach':1A,30B,75C 'asn.1':33B,46B 'asn1':22A,71C 'client':52B,77C 'crash':59B 'cve':8A,16A 'cwe':23B 'deepli':44B,69C 'denial':5A,63B,92C 'except':87C 'fix':105C 'ghsa':12A 'ghsa-x6vc-x4v4-hjhr':11A 'hjhr':15A 'issu':95C,107C 'java':25B 'kerbero':26B 'kerbi':2A,27B,31B,51B,76C 'kerby':21A 'kerby-asn1':20A 'lead':90C 'made':37B 'maven':28B 'mean':61B 'nest':45B,70C 'org.apache.kerby':19A 'overflow':39B 'packag':29B 'parser':34B 'possibl':82C 'recommend':98C 'result':56B 'send':67C 'sent':48B 'servic':7A,54B,65B,79C,94C 'stack':41B 'stackoverflow':86C 'structur':47B,72C 'trigger':84C 'upgrad':100C 'user':96C 'version':102C 'vulner':3A 'x4v4':14A 'x6vc':13A","nicknames":[],"mitigations":[],"who_affected":"Java projects that pull in kerby-asn1 below 2.1.2 and parse ASN.1 data from untrusted sources, such as Kerberos traffic or certificates a client sends. Projects that do not use Kerby, or that only handle trusted ASN.1 input, can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":["orgapachekerbykerbyasn1"],"ptokens":["apache","asn1","kerby","org"],"labels":["cwe400","java","kerberos","kerby","maven","medium","package"],"campaign_type":null,"first_public_at":"2026-06-26T12:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-x6vc-x4v4-hjhr","url":"https://github.com/advisories/GHSA-x6vc-x4v4-hjhr","severity":"medium","published_at":"2026-06-26T12:30:30+00:00","modified_at":"2026-11-03T21:52:35+00:00","first_seen_at":"2026-11-03T21:57:18+00:00","fetched_at":"2026-11-03T21:57:18+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-57914","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57914","severity":null,"published_at":"2026-06-26T12:16:33+00:00","modified_at":"2026-10-25T22:10:00+00:00","first_seen_at":"2026-11-03T22:07:19+00:00","fetched_at":"2026-11-03T22:07:19+00:00","note":null}],"documents":[{"id":61009,"url":"https://github.com/apache/directory-kerby/commit/0bcd73eb9eb54622b84539b5fc23066057c6b5e8","title":"Patch: github.com","kind":"other","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":61010,"url":"https://github.com/apache/directory-kerby/releases/tag/kerby-all-2.1.2","title":"Release: github.com","kind":"release","source":"ghsa","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Release: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}