CVE-2026-57914

MediumCVSS 6.5

Published: 26/06/2026(UTC)Updated: 26/06/2026(UTC)Translated: 27/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.29%

21th percentile — higher than 21% of all known CVEs

Summary

Sending a deeply nested ASN1 structure to an Apache Kerby client or service can trigger a StackOverFlow exception, leading to denial of service (DoS).

Risk Assessment

An attacker can remotely crash the Kerby service, preventing authentication and disrupting dependent systems.

Recommendation

Upgrade Apache Kerby to version 2.1.2 immediately, which includes a fix for this vulnerability.

Original NVD description (English source)

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.