CVE-2026-11873

Summary

An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.

Affected Software

Weaknesses

• CWE-209: Generation of Error Message Containing Sensitive Information

Workarounds

Make the CA REST API fail safely by checking authentication early and returning simple 4xx errors for malformed requests without stack traces, and tune exception handling and logging so attacker-controlled input cannot spam large stack-trace logs (rate-limit/truncate).

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

References

• https://access.redhat.com/security/cve/CVE-2026-11873
• https://bugzilla.redhat.com/show_bug.cgi?id=2487505

• ←Previous
• Next→