Medium [CVE-2026-11873] Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes http 500, java exception, and stacktrace disclosure
This medium-severity Red Hat Linux advisory covers CVE-2026-11873 affecting Red Hat Certificate System 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests.
The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.
Rated Moderate because the flaw only discloses internal stack traces and class names rather than sensitive data, and the availability impact is limited to gradual log-driven disk/I/O pressure rather than directly crashing the service. No code execution, authentication bypass, or direct compromise results from the flaw.
Red Hat severity: Moderate — CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L). Weakness: CWE-209.
Affected Red Hat products: Red Hat Certificate System 9; Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9. Will not fix / out of support: Red Hat Enterprise Linux 6.
Red Hat does not currently list a fixing RHSA for this CVE.
Affected products named by the advisory: Red Hat package: dogtag-pki.src; Red Hat package: idm-pki-acme; Red Hat package: idm-pki-ca; Red Hat package: idm-pki-java; and 27 more.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Fixed versions
No fixed release is recorded yet. That does not prove no patch exists — confirm against the vendor advisory.
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Mitigation checklist
- Make the CA REST API fail safely by checking authentication early and returning simple 4xx errors for malformed requests without stack traces, and tune exception handling and logging so attacker-controlled input cannot spam large stack-trace logs (rate-limit/truncate).
Official advisory · high-confidence parse· fetched 1 hour ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.