What is the CVSS score of CVE-2026-57914?

CVE-2026-57914 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Is there a patch available for CVE-2026-57914?

Yes, a patch is available for CVE-2026-57914. Update the affected software to the latest version immediately.

Apache Kerby CVE-2026-57914

EUVD-2026-39648 MEDIUM

Uncontrolled Resource Consumption (CWE-400)

2026-06-26 apache

GHSA-x6vc-x4v4-hjhr

Denial Of Service Apache Red Hat Apache Kerby Apache Software Foundation

6.5

CVSS 3.1 · Vendor: apache

Severity by source

Vendor (apache) PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Network-reachable pre-auth ASN.1 parsing, no interaction needed, impact is complete service availability loss only.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Red Hat

6.5 MEDIUM

qualitative

Primary rating from Vendor (apache).

CVSS VectorVendor: apache

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch available

Jun 26, 2026 - 13:01 EUVD

Analysis Generated

Jun 26, 2026 - 12:20 vuln.today

DescriptionCVE.org

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it's possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

AnalysisAI

Denial of service in Apache Kerby allows remote attackers to crash a Kerby client or service by delivering a deeply nested ASN1 structure that exhausts JVM stack depth and triggers an unhandled StackOverflowException. All versions prior to 2.1.2 are affected. No public exploit code or CISA KEV listing has been identified at time of analysis, but the attack primitive (malformed Kerberos ASN1 message) requires no authentication and is trivially constructible, making this a realistic operational risk for any internet- or network-exposed Kerby deployment.

Technical ContextAI

Apache Kerby is a Java-based Kerberos library used within the Apache ecosystem - notably embedded in Apache Hadoop security infrastructure and Apache Directory Server (ApacheDS). Kerberos protocol messages are encoded in ASN.1 (Abstract Syntax Notation One) with BER/DER encoding, and Kerby must parse these structures before authentication is validated. CWE-400 (Uncontrolled Resource Consumption) identifies the root cause: the ASN.1 parser processes arbitrarily nested structures recursively without a depth limit or iterative safeguard, allowing an attacker to exhaust the JVM call stack. The CPE string cpe:2.3:a:apache_software_foundation:apache_kerby:*:*:*:* covers all Kerby versions, indicating no version prior to the patch is exempt. Because ASN.1 parsing is required to decode any incoming Kerberos message, this vulnerability sits squarely on the unauthenticated protocol boundary.

RemediationAI

Upgrade Apache Kerby to version 2.1.2, the vendor-confirmed fix version as documented in the Apache mailing list advisory at https://lists.apache.org/thread/w98h2q8wz0bq97vhz4vf55hqomcb2j1m. For projects embedding Kerby transitively (e.g., Apache Hadoop, ApacheDS), update the parent project to a release that bundles Kerby 2.1.2 or later, and verify the resolved version via dependency inspection (e.g., mvn dependency:tree or gradle dependencies). If an immediate upgrade is not feasible, a compensating control is to place a network-layer filter or authentication proxy in front of Kerby endpoints to reject connections from untrusted sources, reducing exposure to crafted ASN.1 input. This has the trade-off of restricting legitimate unauthenticated Kerberos AS-REQ flows and may break standard Kerberos client behavior; it should be treated as a temporary measure only.