CVE-2026-11873: IdM Dogtag CA REST Endpoint DoS Vulnerability

CVE-2026-11873 Overview

CVE-2026-11873 affects the Apache-proxied Dogtag Certificate Authority (CA) REST endpoint exposed by Red Hat Identity Management (IdM). The POST /ca/rest/certrequests endpoint returns HTTP 500 responses containing internal Java stack traces when it receives unauthenticated malformed requests. The same error path writes large multi-line stack traces to the CA debug log. Unauthenticated attackers can abuse this behavior to leak internal implementation details and to force disk growth and I/O contention on the CA host. The issue is classified under CWE-209: Generation of Error Message Containing Sensitive Information.

Critical Impact
Unauthenticated remote attackers can extract Java stack traces from a public CA REST endpoint and amplify disk and I/O consumption in the CA debug log without valid credentials.

Affected Products

Red Hat Identity Management (IdM)
Dogtag Certificate System (CA subsystem)
Apache-proxied /ca/rest/certrequests endpoint exposed by IdM

Discovery Timeline

2026-09-01 - CVE-2026-11873 published to NVD
2026-09-01 - Last updated in NVD database

Technical Details for CVE-2026-11873

Vulnerability Analysis

The Dogtag CA subsystem within Red Hat IdM exposes the REST endpoint POST /ca/rest/certrequests through an Apache reverse proxy. When the endpoint receives a malformed request without authentication, the server returns an HTTP 500 response body that includes verbose Java stack traces. These traces reveal internal class names, method signatures, and package structures within the CA implementation.

The same unauthenticated error path writes the full multi-line stack trace to the CA debug log. An attacker who repeatedly submits malformed payloads can inflate the debug log, causing disk space exhaustion and I/O contention on the CA host. Both effects require no valid credentials and no user interaction. The vulnerability maps to CWE-209 because sensitive internal information is disclosed through error messages.

Root Cause

The root cause is an unauthenticated error-handling path that fails to sanitize exception output before returning it to the caller and before writing it to disk. Malformed input triggers Java exceptions that propagate to the response body and to the CA debug logger without redaction, rate limiting, or authentication checks.

Attack Vector

The endpoint is reachable over the network without authentication. An attacker sends crafted malformed HTTP POST requests to /ca/rest/certrequests on the Apache-proxied IdM host. Each request yields a stack trace in the HTTP response and a corresponding stack trace written to the CA debug log. Repeated requests amplify log growth and I/O pressure on the CA server.

No verified public exploit code is available. See the Red Hat CVE-2026-11873 Advisory and Red Hat Bug Report #2487505 for vendor-provided technical detail.

Detection Methods for CVE-2026-11873

Indicators of Compromise

Repeated unauthenticated POST requests to /ca/rest/certrequests from a single source in Apache access logs.
HTTP 500 response bursts on the CA REST endpoint correlated with malformed request bodies.
Rapid growth of the Dogtag CA debug log and rising disk utilization on the CA host.
Java stack trace fragments appearing in outbound response bodies captured by web proxies or WAFs.

Detection Strategies

Alert on high-rate HTTP 500 responses from /ca/rest/certrequests where the request lacks authentication headers.
Monitor the CA debug log for sustained write rates or stack-trace patterns tied to certrequests handling.
Baseline disk consumption on the CA server and alert on abnormal growth of Dogtag log directories.

Monitoring Recommendations

Ingest Apache access and error logs plus Dogtag CA debug logs into a centralized log platform for correlation.
Track request rate, source IP, and User-Agent distributions targeting /ca/rest/* paths.
Configure filesystem monitoring on the CA log volume with thresholds tuned below the point of I/O contention.

How to Mitigate CVE-2026-11873

Immediate Actions Required

Apply Red Hat updates for IdM and Dogtag Certificate System as they become available in the Red Hat CVE-2026-11873 Advisory.
Restrict network exposure of the Apache-proxied /ca/rest/certrequests endpoint to trusted management networks.
Enforce rate limiting at the reverse proxy for unauthenticated requests to /ca/rest/*.
Rotate and size-cap CA debug logs and provision additional headroom on the log volume.

Patch Information

Refer to the Red Hat CVE-2026-11873 Advisory and Red Hat Bug Report #2487505 for fixed package versions and errata. Apply vendor patches for the Dogtag CA subsystem shipped with Red Hat IdM on all directory server and CA replicas.

Workarounds

Place an Apache or WAF rule in front of /ca/rest/certrequests that rejects unauthenticated requests with malformed content types or bodies.
Lower the Dogtag CA debug log verbosity and enable aggressive log rotation with strict size limits.
Block internet exposure of the IdM CA REST interface and require VPN or mTLS for administrative access.
Monitor and alert on stack-trace strings in HTTP response bodies leaving the IdM host.

bash

# Example Apache rate-limit and path restriction (illustrative)
<Location "/ca/rest/certrequests">
    Require ip 10.0.0.0/8
    # Requires mod_ratelimit or mod_qos
    SetOutputFilter RATE_LIMIT
    SetEnv rate-limit 50
</Location>