CVE-2026-11873

An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) returns HTTP 500 with internal Java stack traces for unauthenticated malformed requests. The same unauthenticated error path emits large multi-line stack traces into the CA debug log, creating a log-amplification resource exhaustion vector (disk growth and I/O contention) without requiring authentication.

Rated Moderate because the flaw only discloses internal stack traces and class names rather than sensitive data, and the availability impact is limited to gradual log-driven disk/I/O pressure rather than directly crashing the service. No code execution, authentication bypass, or direct compromise results from the flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Make the CA REST API fail safely by checking authentication early and returning simple 4xx errors for malformed requests without stack traces, and tune exception handling and logging so attacker-controlled input cannot spam large stack-trace logs (rate-limit/truncate).