ALSA-2026:92408: Important: dogtag-pki security update

Q: Which deployed IdM PKI functions should be included in the update assessment?

Assess systems providing any of the listed IdM PKI functions: CA, KRA, OCSP Manager, TKS, TPS, ACME Responder, or EST Responder. The update covers idm-pki-acme, idm-pki-base, idm-pki-ca, idm-pki-java, idm-pki-kra, idm-pki-server, idm-pki-tools, and python3-idm-pki.

Q: Does the advisory indicate that a particular CORS configuration increases exposure?

Yes. One addressed issue involves a CORS filter reflecting an arbitrary origin with credentials under a wildcard configuration. The advisory does not state whether that configuration is enabled by default.

Q: What denial-of-service conditions are addressed by this update?

The update addresses unbounded image decoding described as a decompression-bomb denial of service, and a Jackson-core denial of service caused by regular-expression backtracking. The advisory does not provide exploit prerequisites or mitigation steps other than applying the security update.

Published Oct 29, 2026

Updated

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:

Certificate Authority (CA) Key Recovery Authority (KRA) Online Certificate Status Protocol (OCSP) Manager Token Key Service (TKS) Token Processing Service (TPS) Automatic Certificate Management Environment (ACME) Responder Enrollment over Secure Transport (EST) Responder

Security Fix(es):

resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059) resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058) com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

8 affected componentsFixes available

almalinux/idm-pki-acme<11.9.0-6.el10_2.1.alma.1

11.9.0-6.el10_2.1.alma.1

almalinux/idm-pki-base<11.9.0-6.el10_2.1.alma.1

11.9.0-6.el10_2.1.alma.1

almalinux/idm-pki-ca<11.9.0-6.el10_2.1.alma.1

11.9.0-6.el10_2.1.alma.1

almalinux/idm-pki-java<11.9.0-6.el10_2.1.alma.1

11.9.0-6.el10_2.1.alma.1

almalinux/idm-pki-kra<11.9.0-6.el10_2.1.alma.1

11.9.0-6.el10_2.1.alma.1

almalinux/idm-pki-server<11.9.0-6.el10_2.1.alma.1

11.9.0-6.el10_2.1.alma.1

almalinux/idm-pki-tools<11.9.0-6.el10_2.1.alma.1

11.9.0-6.el10_2.1.alma.1

almalinux/python3-idm-pki<11.9.0-6.el10_2.1.alma.1

11.9.0-6.el10_2.1.alma.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade almalinux/idm-pki-acme to a version that resolves this vulnerability.
Fixed in 11.9.0-6.el10_2.1.alma.1
Upgrade
Upgrade almalinux/idm-pki-base to a version that resolves this vulnerability.
Fixed in 11.9.0-6.el10_2.1.alma.1
Upgrade
Upgrade almalinux/idm-pki-ca to a version that resolves this vulnerability.
Fixed in 11.9.0-6.el10_2.1.alma.1
Upgrade
Upgrade almalinux/idm-pki-java to a version that resolves this vulnerability.
Fixed in 11.9.0-6.el10_2.1.alma.1
Upgrade
Upgrade almalinux/idm-pki-kra to a version that resolves this vulnerability.
Fixed in 11.9.0-6.el10_2.1.alma.1
Upgrade
Upgrade almalinux/idm-pki-server to a version that resolves this vulnerability.
Fixed in 11.9.0-6.el10_2.1.alma.1
Upgrade
Upgrade almalinux/idm-pki-tools to a version that resolves this vulnerability.
Fixed in 11.9.0-6.el10_2.1.alma.1
Upgrade
Upgrade almalinux/python3-idm-pki to a version that resolves this vulnerability.
Fixed in 11.9.0-6.el10_2.1.alma.1

Event History

Oct 29, 2026

Advisory Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

Frequently Asked Questions

Which deployed IdM PKI functions should be included in the update assessment?

Assess systems providing any of the listed IdM PKI functions: CA, KRA, OCSP Manager, TKS, TPS, ACME Responder, or EST Responder. The update covers idm-pki-acme, idm-pki-base, idm-pki-ca, idm-pki-java, idm-pki-kra, idm-pki-server, idm-pki-tools, and python3-idm-pki.

Does the advisory indicate that a particular CORS configuration increases exposure?

Yes. One addressed issue involves a CORS filter reflecting an arbitrary origin with credentials under a wildcard configuration. The advisory does not state whether that configuration is enabled by default.

What denial-of-service conditions are addressed by this update?

The update addresses unbounded image decoding described as a decompression-bomb denial of service, and a Jackson-core denial of service caused by regular-expression backtracking. The advisory does not provide exploit prerequisites or mitigation steps other than applying the security update.

ALSA-2026:92408: Important: dogtag-pki security update

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Which deployed IdM PKI functions should be included in the update assessment?

Does the advisory indicate that a particular CORS configuration increases exposure?

What denial-of-service conditions are addressed by this update?

Company

Resources

Contact

Frequently Asked Questions

Which deployed IdM PKI functions should be included in the update assessment?

Does the advisory indicate that a particular CORS configuration increases exposure?

What denial-of-service conditions are addressed by this update?