Executive brief
Apache Kerby is a Java-based implementation of the Kerberos network authentication protocol. A vulnerability in how it processes security data structures could allow an attacker to crash the service or client application by sending a specially crafted, deeply nested message. This results in a denial-of-service (DoS) condition, preventing legitimate users from authenticating or accessing protected resources.
Technical details
A vulnerability exists in the ASN1 parsing component of Apache Kerby (specifically kerby-asn1). The issue is caused by uncontrolled recursion when processing deeply nested ASN1 structures, which triggers a StackOverflowError. An unauthenticated remote attacker can exploit this by sending a specially crafted ASN1 structure to a Kerby-based client or service. Successful exploitation leads to a denial-of-service (DoS) condition as the application or service crashes. This issue is addressed in Apache Kerby version 2.1.2.
Affected products
- Apache Software Foundation Apache Kerby versions before 2.1.2
Timeline
- 2026-06-26: disclosed: Vulnerability disclosed by Apache Software Foundation
- 2026-06-26: advisory: NVD record published