CVE-2026-57914: Apache Kerby vulnerable to denial of service
By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.apache.kerby:kerby-asn1to a version that resolves this vulnerability.Fixed in 2.1.2 - Upgrade
Upgrade
Apache Kerbyto a version that resolves this vulnerability.Fixed in 2.1.2
Event History
Frequently Asked Questions
What is the severity of CVE-2026-57914?
CVE-2026-57914 is classified with a risk score of 26, indicating a high severity vulnerability.
How do I fix CVE-2026-57914?
To resolve CVE-2026-57914, users should upgrade to Apache Kerby version 2.1.2 or later.
What type of vulnerability is CVE-2026-57914?
CVE-2026-57914 is a denial of service vulnerability caused by a StackOverflow exception when handling deeply nested ASN1 structures.
Which versions of Apache Kerby are affected by CVE-2026-57914?
CVE-2026-57914 affects all versions of Apache Kerby prior to version 2.1.2.
Is CVE-2026-57914 a remote exploit?
Yes, CVE-2026-57914 can be exploited remotely by sending a crafted ASN1 structure to an affected Apache Kerby service.