Red HatCVE-2026-18047
Red Hat Dogtag PKI: denial of service
Medium6.5CVE-2026-18047 · Published Jul 28, 2026
A flaw was found in Dogtag PKI's ACME responder where the web.xml security constraints use exact URL pattern matching for admin-only enable/disable endpoints. By appending a trailing slash to the URL, an unauthenticated attacker can bypass the Tomcat authentication constraint while RESTEasy still routes the request to the handler, allowing unauthorized toggling of the ACME service state including persistent denial of service.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Certificate System 10 Product | all versions | No fix yet |
| Red Hat Certificate System 11 Product | all versions | No fix yet |
| Red Hat Certificate System 9 Product | all versions | No fix yet |
| all versions | No fix yet | |
| Red Hat Enterprise Linux 10 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 6 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 7 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 8 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 9 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-288
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Jul 28 | Red Hat CRIU: code injection | High7.8 | No fix yet |
| Jul 28 | Red Hat sg3_utils. The sg_inq command: code execution | High7.6 | No fix yet |
| Jul 28 | A flaw was found in openshift/oauth-proxy | High8.5 | No fix yet |
| Jul 28 | Red Hat GStreamer: out-of-bounds read | Low3.3 | No fix yet |
| Jul 27 | Red Hat file-sgi plugin: integer overflow | Medium5.5 | No fix yet |
| Jul 27 | Red Hat file-fits plugin: integer overflow | High7.8 | No fix yet |