Executive brief
Red Hat Identity Management exposes a certificate authority REST API endpoint that returns detailed internal error messages and Java stack traces when receiving malformed requests, without requiring authentication. An attacker can repeatedly send crafted requests to generate massive log entries, exhausting disk space and degrading system performance, though no data is directly compromised or service directly crashed.
Technical details
The vulnerability is an information disclosure combined with log amplification (CWE-209) in the Apache-proxied Dogtag CA REST endpoint (POST /ca/rest/certrequests) exposed by Red Hat Identity Management. Unauthenticated attackers can send malformed requests that trigger Java exceptions, causing the service to return HTTP 500 responses with detailed stack traces in the response body and emit large multi-line stack traces to the CA debug log. An attacker can exploit this without authentication or user interaction by sending repeated malformed requests to amplify log file growth, causing disk exhaustion and I/O contention that degrades availability. The fix involves early authentication checks, safe error handling with simple 4xx responses, and log rate-limiting or truncation to prevent attacker-controlled input from spamming large debug logs.
Affected products
- Red Hat Identity Management <UNKNOWN>
Timeline
- 2026-09-01: disclosed
- 2026-09-01: advisory