CVE-2026-57914 Apache Kerby: StackOverflow on parsing deeply nested ASN1 structures

🗓️ 26 Jun 2026 11:28:26Reported by apacheType

Sending a deeply nested ASN.1 structure to Apache Kerby may cause a stack overflow and denial of service; upgrade to version 2.1.2.

Reporter	Title	Published	Views	Family All 15
IBM Security Bulletins	Security Bulletin: IBM SPSS Modeler is affected by vulnerabilities in Apache Kerby	13 Aug 202610:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Tivoli Network Manager IP Edition	10 Jul 202608:21	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by multiple vulnerabilities in Apache Kerby	11 Aug 202616:25	–	ibm
ATTACKERKB	CVE-2026-57914	26 Jun 202611:28	–	attackerkb
Circl	CVE-2026-57914	26 Jun 202617:56	–	circl
CVE	CVE-2026-57914	26 Jun 202611:28	–	cve
EUVD	EUVD-2026-39648	26 Jun 202611:28	–	euvd
NVD	CVE-2026-57914	26 Jun 202612:16	–	nvd
OSV	CLEANSTART-2026-BK55944 Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2026-42198, CVE-2026-42577, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-44249, CVE-2026-44893, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-47244, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-50010, CVE-2026-50020, CVE-2026-50559, CVE-2026-50560, CVE-2026-54291, CVE-2026-54512, CVE-2026-54513, CVE-2026-54514, CVE-2026-54515, CVE-2026-54516, CVE-2026-54517, CVE-2026-54518, CVE-2026-5588, CVE-2026-5598, CVE-2026-57914, CVE-2026-9563, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-98qh-xjc8-98pq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cc37-9q2j-3hfv, ghsa-h2qv-fj59-j46j, ghsa-hvcg-qmg6-jm4c, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-rc95-pcm8-65v9, ghsa-v8h7-rr48-vmmv, ghsa-w573-9ffj-6ff9, ghsa-w9fj-cfpg-grvv, ghsa-wg6q-6289-32hp, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 26.5.6-r3, 26.6.1-r1, 26.6.3-r2, 26.6.3-r3	21 Jul 202606:46	–	osv
OSV	CLEANSTART-2026-LC38113 Security fixes in keycloak 26.4.7-r5	30 Jul 202607:10	–	osv

[
  {
    "collectionURL": "https://repo.maven.apache.org/maven2",
    "defaultStatus": "unaffected",
    "packageName": "org.apache.kerby:kerby-asn1",
    "product": "Apache Kerby",
    "vendor": "Apache Software Foundation",
    "versions": [
      {
        "lessThan": "2.1.2",
        "status": "affected",
        "version": "0",
        "versionType": "semver"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread/w98h2q8wz0bq97vhz4vf55hqomcb2j1m

26 Jun 2026 11:28Current

EPSS0.00436

CWE-400