---
id: CVE-2026-11873
title: >-
  Pki-core: dogtag-pki: empty request to dogtag /ca/rest/certrequests causes
  http 500, java exception, and stacktrace disclosure
summary: >-
  An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST
  /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for
  unauthenticated malformed requests. The same unauthenticated error path emits
  large multi-line sta…
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L'
cvssSource: cna
cwe:
  - CWE-209
vendor: Red Hat
product: pki-core
affected:
  - pki-core (all versions)
  - dogtag-pki (all versions)
  - pki-core
  - pki-core (all versions)
  - pki-core (all versions)
  - pki-core (all versions)
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: partial
  timestamp: '2026-09-01T17:42:26.127581Z'
published: '2026-09-01'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T16:22:50.289Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-11873'
references:
  - url: 'https://access.redhat.com/security/cve/CVE-2026-11873'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2487505'
    label: RHBZ#2487505
tags:
  - cve.org
epss: 0.00456
epssPercentile: 0.3975
ingestedAt: '2026-11-05T22:38:31.346Z'
---

## Overview

An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.

## Affected

- `pki-core (all versions)`
- `dogtag-pki (all versions)`
- `pki-core`
- `pki-core (all versions)`
- `pki-core (all versions)`
- `pki-core (all versions)`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

### Workarounds

Make the CA REST API fail safely by checking authentication early and returning simple 4xx errors for malformed requests without stack traces, and tune exception handling and logging so attacker-controlled input cannot spam large stack-trace logs (rate-limit/truncate).