{"id":"CVE-2026-57914","aliases":["GHSA-x6vc-x4v4-hjhr"],"title":"Apache Kerby vulnerable to denial of service","summary":"Apache Kerby vulnerable to denial of service","severity":"medium","cvss":6.5,"cwe":["CWE-400"],"vendor":"apache","product":"org.apache.kerby:kerby-asn1","ecosystem":"maven","affected":["org.apache.kerby:kerby-asn1 < 2.1.2"],"patched":["org.apache.kerby:kerby-asn1 2.1.2"],"published":"2026-06-26","updated":"2026-11-03","sourceUpdated":"2026-11-03T21:52:35Z","source":"GHSA","sourceUrl":"https://github.com/advisories/GHSA-x6vc-x4v4-hjhr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-57914"},{"url":"https://lists.apache.org/thread/w98h2q8wz0bq97vhz4vf55hqomcb2j1m"},{"url":"http://www.openwall.com/lists/oss-security/2026/06/26/7"},{"url":"https://github.com/apache/directory-kerby/commit/0bcd73eb9eb54622b84539b5fc23066057c6b5e8"},{"url":"https://github.com/apache/directory-kerby/releases/tag/kerby-all-2.1.2"},{"url":"https://github.com/advisories/GHSA-x6vc-x4v4-hjhr"}],"tags":["ghsa","maven"],"epss":0.00436,"epssPercentile":0.37989,"ingestedAt":"2026-11-03T21:55:50.534Z","slug":"CVE-2026-57914","body":"## Overview\n\nBy sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.\n\n## Affected packages\n\n- `org.apache.kerby:kerby-asn1 < 2.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `org.apache.kerby:kerby-asn1 2.1.2`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}