Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

A flaw was found in Dogtag PKI's ACME responder. The web.xml security constraints protecting the admin-only /v1/enable and /v1/disable endpoints use exact URL pattern matching (/v1/enable and /v1/disable). Due to a path normalization inconsistency between Tomcat's security constraint matching (which requires exact path match per Servlet spec §12.2) and RESTEasy's JAX-RS path routing (which normalizes trailing slashes), a request to /v1/enable/ bypasses the authentication constraint while still being routed to ACMEEnableService.handlePOST(). Neither ACMEEnableService nor ACMEDisableService performs application-level authorization checks — they directly call database.setEnabled(true/false). An unauthenticated remote attacker can exploit this to enable or disable ACME services, allowing persistent denial of service by repeatedly disabling the service, or re-enabling a service that was intentionally disabled by an administrator.