Apache Kerby CVE-2026-57914

The target system must be running Apache Kerby in any version prior to 2.1.2 as either a KDC service or a Kerby-enabled client that accepts inbound Kerberos messages. Because ASN.1 parsing in Kerberos occurs before credential validation, no authentication or session establishment is required - the attacker need only reach the Kerby network endpoint (typically UDP/TCP port 88 for a KDC). There are no documented non-default configuration requirements; the vulnerability is present in the default ASN.1 parsing code path. Exploitation is limited to availability impact only; no credential theft or code execution has been described. Environments that restrict KDC port access via firewall to known Kerberos clients reduce but do not eliminate exposure, since any permitted client could be compromised or spoofed.

No CVSS vector or EPSS score was provided in the source data, so risk metrics must be independently assessed. The attack vector is network-reachable (ASN.1 parsing occurs pre-authentication in Kerberos), complexity is low (a crafted nested structure is straightforward to construct), and no privileges are required. The impact is limited to availability - a full service crash - but repeated exploitation could sustain an outage indefinitely. KEV status is not confirmed and no public PoC has been identified at time of analysis. Despite the absence of those high-urgency signals, the combination of unauthenticated network reach, low complexity, and a hard crash (not graceful degradation) places practical risk in the high tier for organizations running Kerby-based Kerberos infrastructure, particularly Hadoop clusters where Kerby underpins security. There is no EPSS data to qualify exploitation probability further - this gap should be revisited once NVD scoring is published.

An unauthenticated attacker on the network sends a single Kerberos AS-REQ message to a Kerby-backed KDC or service endpoint, embedding a deeply nested ASN.1 SEQUENCE structure that exceeds the JVM default stack depth during recursive parsing. The Kerby process throws an uncaught StackOverflowError and terminates, immediately disrupting authentication for all clients relying on that endpoint. No prior exploit code has been publicly identified, but constructing such a payload requires only basic ASN.1 encoding knowledge and is achievable with off-the-shelf tools.