CVE-2026-57914: Apache Software Foundation Apache Kerby

Medium severity, CVSS 6.5. EPSS: 0.4% chance of exploitation in the next 30 days.

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

Affected products

• Apache Software Foundation Apache Kerby: before 2.1.2 (fixed in 2.1.2)

Published 2026-06-26. Last modified 2026-06-26.