RHSA-2026:98606: Important: dogtag-pki security update

Q: Which IdM PKI services may be relevant to this update?

The update applies to IdM PKI components including CA, KRA, OCSP Manager, TKS, TPS, ACME Responder, and EST Responder. Listed packages also include idm-pki-base, idm-pki-ca, idm-pki-acme, idm-pki-java, and idm-pki-tools.

Q: What types of impact are addressed by the included fixes?

The fixes address denial-of-service conditions in RESTEasy and Jackson components, including decompression-bomb image decoding, regular-expression backtracking, malformed-token processing, and quadratic forward-reference completion. They also address a RESTEasy CORS issue where arbitrary origins can be reflected with credentials when wildcard configuration is used.

Q: What configuration condition is identified for the CORS issue?

The CORS issue is described as occurring under wildcard configuration and can reflect an arbitrary Origin with credentials. The advisory does not provide further configuration or mitigation details.

Published Nov 11, 2026

Updated

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components: Certificate Authority (CA) Key Recovery Authority (KRA) Online Certificate Status Protocol (OCSP) Manager Token Key Service (TKS) Token Processing Service (TPS) Automatic Certificate Management Environment (ACME) Responder Enrollment over Secure Transport (EST) Responder Security Fix(es): resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059) resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058) com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407) com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing (CVE-2026-89425) com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion (CVE-2026-91777) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Affected Software

20 affected componentsFixes available

redhat/dogtag-pki<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/dogtag-pki-debugsource<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-acme<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-base<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-ca<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-java<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-kra<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-server<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-tools<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-tools-debuginfo<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/python3-idm-pki<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/dogtag-pki-debugsource<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-tools<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-tools-debuginfo<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/dogtag-pki-debugsource<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-tools<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/idm-pki-tools-debuginfo<11.9.0-9.el10_3.1

11.9.0-9.el10_3.1

redhat/dogtag-pki-debugsource<11.9.0-9.el10_3.1.aa

11.9.0-9.el10_3.1.aa

redhat/idm-pki-tools<11.9.0-9.el10_3.1.aa

11.9.0-9.el10_3.1.aa

redhat/idm-pki-tools-debuginfo<11.9.0-9.el10_3.1.aa

11.9.0-9.el10_3.1.aa

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade redhat/dogtag-pki to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/dogtag-pki-debugsource to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/idm-pki-acme to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/idm-pki-base to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/idm-pki-ca to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/idm-pki-java to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/idm-pki-kra to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/idm-pki-server to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/idm-pki-tools to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/idm-pki-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/python3-idm-pki to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1
Upgrade
Upgrade redhat/dogtag-pki-debugsource to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1.aa
Upgrade
Upgrade redhat/idm-pki-tools to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1.aa
Upgrade
Upgrade redhat/idm-pki-tools-debuginfo to a version that resolves this vulnerability.
Fixed in 11.9.0-9.el10_3.1.aa

Event History

Nov 11, 2026

Advisory Published

via Red Hat·12:00 AM

Data Sourced

via Red Hat·12:00 AM

RemedyDescriptionAffected Software

Frequently Asked Questions

Which IdM PKI services may be relevant to this update?

The update applies to IdM PKI components including CA, KRA, OCSP Manager, TKS, TPS, ACME Responder, and EST Responder. Listed packages also include idm-pki-base, idm-pki-ca, idm-pki-acme, idm-pki-java, and idm-pki-tools.

What types of impact are addressed by the included fixes?

The fixes address denial-of-service conditions in RESTEasy and Jackson components, including decompression-bomb image decoding, regular-expression backtracking, malformed-token processing, and quadratic forward-reference completion. They also address a RESTEasy CORS issue where arbitrary origins can be reflected with credentials when wildcard configuration is used.

What configuration condition is identified for the CORS issue?

The CORS issue is described as occurring under wildcard configuration and can reflect an arbitrary Origin with credentials. The advisory does not provide further configuration or mitigation details.

RHSA-2026:98606: Important: dogtag-pki security update

Affected Software

Remediation

Event History

Frequently Asked Questions

Which IdM PKI services may be relevant to this update?

What types of impact are addressed by the included fixes?

What configuration condition is identified for the CORS issue?

Company

Resources

Contact

Frequently Asked Questions

Which IdM PKI services may be relevant to this update?

What types of impact are addressed by the included fixes?

What configuration condition is identified for the CORS issue?