CVE-2026-57914: Apache Kerby vulnerable to denial of service

June 26, 2026 (updated November 3, 2026)

By sending a deeply nested ASN1 structure to a Apache Kerby client or service, it’s possible to trigger a StackOverFlow Exception which can lead to denial of service issues. Users are recommended to upgrade to version 2.1.2, which fixes this issue.

References

github.com/advisories/GHSA-x6vc-x4v4-hjhr
github.com/apache/directory-kerby/commit/0bcd73eb9eb54622b84539b5fc23066057c6b5e8
github.com/apache/directory-kerby/releases/tag/kerby-all-2.1.2
lists.apache.org/thread/w98h2q8wz0bq97vhz4vf55hqomcb2j1m
nvd.nist.gov/vuln/detail/CVE-2026-57914

Code Behaviors & Features

Detect and mitigate CVE-2026-57914 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →