CVE-2026-11873: Generation of Error Message Containing Sensitive Information in Red Hat Red Hat Certificate System 9

An Apache-proxied Dogtag CA REST endpoint exposed by IdM (POST /ca/rest/certrequests) in Red Hat Certificate System 9 returns HTTP 500 errors with internal Java stack traces when receiving unauthenticated malformed requests. These requests also cause large multi-line stack traces to be logged in the CA debug log, creating a log-amplification vector that can exhaust disk space and cause I/O contention without requiring authentication. The vulnerability discloses internal stack traces and class names but does not expose sensitive data or allow code execution or authentication bypass. The availability impact is limited to gradual resource exhaustion rather than immediate service crash. The vendor advisory recommends improving authentication checks early in the request handling and tuning exception handling and logging to prevent large stack-trace logs from unauthenticated malformed requests.

The vulnerability leads to low confidentiality impact by disclosing internal Java stack traces and class names in HTTP 500 error responses and debug logs. It causes a low availability impact due to potential log-driven disk growth and I/O contention, which could degrade service performance over time. There is no impact on integrity, no code execution, and no authentication bypass. No sensitive data is directly exposed, and the service does not crash immediately but may experience gradual resource exhaustion.

No official fix or patch has been confirmed yet. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. The vendor recommends making the CA REST API fail safely by performing authentication checks early and returning simple 4xx errors for malformed requests without stack traces. Additionally, tuning exception handling and logging to rate-limit or truncate attacker-controlled input can prevent log amplification. Users should monitor the Red Hat advisory page for updates and apply any forthcoming patches or official mitigations.