Is CVE-2026-11873 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-11873 being exploited in the wild.

How severe is CVE-2026-11873?

Medium severity, with a CVSS score of 6.5, published 1 September 2026.

Is there a fix for CVE-2026-11873?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-11873 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-11873?

Check whether you run Red Hat Identity Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-11873: Red Hat Identity Management Dogtag CA REST endpoint stack trace disclosure

CVE-2026-11873 · Severity: medium · CVSS 6.5 · Published 2026-09-01

Red Hat Identity Management exposes a certificate authority REST API endpoint that returns detailed internal error messages and Java stack traces when receiving malformed requests, without requiring authentication. An attacker can repeatedly send crafted requests to generate massive log entries, exhausting disk space and degrading system performance, though no data is directly compromised or service directly crashed.

Vendors: Red Hat.

Quick answers

Is CVE-2026-11873 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-11873 being exploited in the wild.
How severe is CVE-2026-11873?: Medium severity, with a CVSS score of 6.5, published 1 September 2026.
Which products and versions are affected?: Red Hat Identity Management <UNKNOWN>.
Is there a fix for CVE-2026-11873?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-11873 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-11873?: Check whether you run Red Hat Identity Management at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability is an information disclosure combined with log amplification (CWE-209) in the Apache-proxied Dogtag CA REST endpoint (POST /ca/rest/certrequests) exposed by Red Hat Identity Management. Unauthenticated attackers can send malformed requests that trigger Java exceptions, causing the service to return HTTP 500 responses with detailed stack traces in the response body and emit large multi-line stack traces to the CA debug log. An attacker can exploit this without authentication or user interaction by sending repeated malformed requests to amplify log file growth, causing disk exhaustion and I/O contention that degrades availability. The fix involves early authentication checks, safe error handling with simple 4xx responses, and log rate-limiting or truncation to prevent attacker-controlled input from spamming large debug logs.

Affected products

Red Hat Identity Management <UNKNOWN>

Timeline

2026-09-01: disclosed
2026-09-01: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.