GHSA-x6vc-x4v4-hjhr

Apache Kerby vulnerable to denial of service

Source: GitHub Advisory Database (reviewed) Moderate CVE-2026-57914

Packages

Ecosystem	Package	Affected	Fixed in
Maven	org.apache.kerby:kerby-asn1	< 2.1.2	2.1.2

Details

As written in the advisory (Markdown source, shown as plain text).

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2026-57914 advisory
https://github.com/apache/directory-kerby/commit/0bcd73eb9eb54622b84539b5fc23066057c6b5e8 web
https://github.com/apache/directory-kerby package
https://github.com/apache/directory-kerby/releases/tag/kerby-all-2.1.2 web
https://lists.apache.org/thread/w98h2q8wz0bq97vhz4vf55hqomcb2j1m web
http://www.openwall.com/lists/oss-security/2026/06/26/7 web