RHLW-2026-1e8b46a3cd8f8900: Lightwell Security Advisory: kerby-asn1 2.0.3.rhlw-00003

Q: What does an attacker need to exploit this issue?

An attacker needs network access to send a deeply nested ASN.1 structure to an Apache Kerby client or service. The supplied severity vector indicates low privileges are required and no user interaction is needed.

Q: What is the operational impact of successful exploitation?

Processing the malicious ASN.1 structure can trigger a StackOverflowException. This can cause a denial-of-service condition; no confidentiality or integrity impact is identified in the supplied severity vector.

Q: Which update should be used to remediate affected deployments?

Upgrade to version 2.1.2, which fixes the issue. Red Hat Lightwell also provides org.apache.kerby:kerby-asn1 2.0.3.rhlw-00003 as a patched, drop-in replacement for org.apache.kerby:kerby-asn1 2.0.3 from Maven Central.

Published Nov 11, 2026

Updated

Red Hat Lightwell has released org.apache.kerby:kerby-asn1 2.0.3.rhlw-00003 with a backported security fix.

CVE-2026-57914: By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

This patched artifact is a drop-in replacement for org.apache.kerby:kerby-asn1 2.0.3 from Maven Central.

Affected Software

1 affected componentFixes available

red-hat-lightwell/org.apache.kerby:kerby-asn1<2.0.3.rhlw-00003

2.0.3.rhlw-00003

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade red-hat-lightwell/org.apache.kerby:kerby-asn1 to a version that resolves this vulnerability.
Fixed in 2.0.3.rhlw-00003
Upgrade
Upgrade org.apache.kerby:kerby-asn1 to a version that resolves this vulnerability.
Fixed in 2.0.3.rhlw-00003
Upgrade
Upgrade org.apache.kerby:kerby-asn1 to a version that resolves this vulnerability.
Fixed in 2.1.2

Event History

Nov 11, 2026

Advisory Published

via OSV·08:19 PM

Data Sourced

via OSV·08:19 PM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-57914

Frequently Asked Questions

What does an attacker need to exploit this issue?

An attacker needs network access to send a deeply nested ASN.1 structure to an Apache Kerby client or service. The supplied severity vector indicates low privileges are required and no user interaction is needed.

What is the operational impact of successful exploitation?

Processing the malicious ASN.1 structure can trigger a StackOverflowException. This can cause a denial-of-service condition; no confidentiality or integrity impact is identified in the supplied severity vector.

Which update should be used to remediate affected deployments?

Upgrade to version 2.1.2, which fixes the issue. Red Hat Lightwell also provides org.apache.kerby:kerby-asn1 2.0.3.rhlw-00003 as a patched, drop-in replacement for org.apache.kerby:kerby-asn1 2.0.3 from Maven Central.

RHLW-2026-1e8b46a3cd8f8900: Lightwell Security Advisory: kerby-asn1 2.0.3.rhlw-00003

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the operational impact of successful exploitation?

Which update should be used to remediate affected deployments?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this issue?

What is the operational impact of successful exploitation?

Which update should be used to remediate affected deployments?