CVE-2026-57914: Apache Kerby DoS Vulnerability

CVE-2026-57914 Overview

CVE-2026-57914 is a denial of service vulnerability in Apache Kerby, an open-source Kerberos protocol implementation written in Java. An attacker can send a deeply nested Abstract Syntax Notation One (ASN1) structure to an Apache Kerby client or service to trigger a StackOverflowError. The uncaught exception terminates request processing and can render the affected component unavailable. The vulnerability is categorized under [CWE-400] Uncontrolled Resource Consumption. Apache has released version 2.1.2 to remediate the issue.

Critical Impact
Authenticated network attackers can crash Apache Kerby clients or services by submitting maliciously crafted ASN1 payloads, causing service unavailability for Kerberos authentication workflows.

Affected Products

Apache Kerby versions prior to 2.1.2
Applications embedding Apache Kerby as a Kerberos client library
Services built on Apache Kerby for KDC (Key Distribution Center) functionality

Discovery Timeline

2026-06-26 - CVE-2026-57914 published to the National Vulnerability Database
2026-06-26 - Last updated in NVD database

Technical Details for CVE-2026-57914

Vulnerability Analysis

Apache Kerby parses ASN1-encoded messages as part of Kerberos protocol operations. Kerberos tickets, authenticators, and PA-DATA fields all rely on ASN1 encoding. The parser uses recursive descent to traverse nested constructed types such as SEQUENCE, SET, and tagged wrappers. When the parser encounters a payload with excessive nesting depth, each level consumes additional stack frames until the Java Virtual Machine (JVM) exhausts its thread stack.

The resulting StackOverflowError propagates outside the parser and terminates the affected worker thread. Repeated requests amplify the impact and can degrade or crash the Kerby service. The flaw affects both client-side and server-side code paths that decode attacker-controlled ASN1 data.

Root Cause

The parser lacks a bounded recursion depth check when decoding nested ASN1 constructed types. The implementation trusts input structure without enforcing a maximum tag nesting limit, so any authenticated peer capable of delivering an ASN1 blob can force unbounded recursion.

Attack Vector

An attacker with low-privilege network access sends a crafted Kerberos message containing thousands of nested ASN1 tags to a listening Kerby endpoint. No user interaction is required. The vulnerability affects availability only, with no impact on confidentiality or integrity. See the Apache Mailing List Thread and OpenWall OSS Security Update for technical details.

Detection Methods for CVE-2026-57914

Indicators of Compromise

java.lang.StackOverflowError entries in Apache Kerby service logs referencing ASN1 decoder classes such as Asn1ParseResult or Asn1Reader
Abrupt worker thread termination immediately after receiving Kerberos AS-REQ or TGS-REQ traffic
Unusually large Kerberos request payloads originating from a single authenticated principal

Detection Strategies

Monitor JVM crash dumps and thread stack traces for recursion depth anomalies in ASN1 parsing code paths
Inspect Kerberos traffic at network sensors for oversized or deeply nested ASN1 structures using protocol-aware DPI rules
Correlate authentication failures with service restart events on hosts running Apache Kerby

Monitoring Recommendations

Alert on repeated StackOverflowError exceptions from Kerby JVMs within short time windows
Track baseline sizes of Kerberos messages and flag statistical outliers
Enable audit logging for authenticated Kerberos clients to identify the source principal of malformed requests

How to Mitigate CVE-2026-57914

Immediate Actions Required

Upgrade Apache Kerby to version 2.1.2 on all clients, KDC servers, and downstream applications that embed the library
Inventory all Java applications that ship Kerby JARs and prioritize internet-facing or multi-tenant deployments
Restrict network exposure of Kerby endpoints to trusted authentication zones

Patch Information

Apache has released Apache Kerby 2.1.2, which adds bounded recursion handling in the ASN1 decoder. Users of all prior versions should upgrade. Refer to the Apache Mailing List Thread for the official announcement.

Workarounds

Place a Kerberos-aware proxy or firewall in front of Kerby services to reject messages exceeding reasonable size thresholds
Configure JVM thread stack size (-Xss) conservatively and enable service auto-restart via systemd or container orchestration to reduce downtime
Limit the set of authenticated principals permitted to reach the KDC administrative interfaces

bash

# Verify installed Apache Kerby version and upgrade via Maven
mvn dependency:tree | grep kerby
# Update pom.xml dependency to the fixed release
# <dependency>
#   <groupId>org.apache.kerby</groupId>
#   <artifactId>kerby-asn1</artifactId>
#   <version>2.1.2</version>
# </dependency>
mvn clean install