CVE-2026-18047

This vulnerability allows an unauthenticated attacker to disable Dogtag PKI's ACME responder by sending a request with a trailing slash to an endpoint that should require authentication. The root cause is a mismatch between how Tomcat evaluates security constraints in web.xml and how RESTEasy normalizes paths for route matching — they apply different rules, so '/acme/directory/admin' fails the constraint while '/acme/directory/admin/' routes successfully to a handler that doesn't enforce the same authorization check. The impact is a persistent denial of service. Toggling ACME off is a state change written to persistent storage, not a transient condition. An attacker need not even want to cause harm — the vulnerability requires no authentication and no special conditions. Reversing it requires administrative access, meaning a single HTTP request can break automated certificate renewal across your entire infrastructure while requiring manual intervention to restore. If you run Dogtag PKI, treat the ACME responder as internet-adjacent even if you think it's internal. The low EPSS score reflects the specialized nature of PKI targets, not exploitation difficulty — the blast radius if exploited is certificate expiration across every workload relying on that CA for automated renewal. Check your Dogtag deployment: verify whether the ACME endpoint is accessible from untrusted networks, and confirm whether any reverse proxies or API gateways normalize trailing slashes before requests reach Dogtag. The safest immediate mitigation is network-level restrictions on the ACME responder until a patch is applied. Also audit whether other administrative endpoints in Dogtag use similar web.xml constraints — if the constraint pattern was copy-pasted, the same bypass likely exists elsewhere in the system. The fix likely normalizes paths either at the container constraint level or inside RESTEasy handlers. The latter is the fragile approach; it patches one endpoint but leaves the architectural split intact. Regardless of where the patch lands, treat this as a signal to review how your container security constraints and application routing layers stay synchronized — they shouldn't rely on implicit alignment.

Reviewed through automated stages and approved by a human before publication.