Sending a deeply nested ASN1 structure to an Apache Kerby client or service can trigger a StackOverflow Exception. The overflow can crash the component, resulting in a denial of service. The weakness is classified as Resource Consumption.

The vulnerability affects Apache Software Foundation:Apache Kerby. All deployments running a version of Kerby older than 2.1.2 are potentially impacted. Upgrading to version 2.1.2 or later mitigates the risk.

EPSS is not available, and the vulnerability is not listed in the CISA KEV catalog, but the nature of a stack overflow suggests a high likelihood that an attacker can exploit the flaw. The CVSS score of 6.5 classifies the vulnerability as moderate severity. The exploit can be delivered remotely by sending a deeply nested ASN1 structure, which the Kerby component parses without depth checks. An attacker does not need local privileges, and once the stack overflows, the affected service can become unresponsive, potentially affecting users and downstream systems.