A flaw was found in Dogtag PKI's ACME responder. The web.xml security constraints protecting the admin-only /v1/enable and /v1/disable endpoints use exact URL pattern matching (/v1/enable and /v1/disable). Due to a path normalization inconsistency between Tomcat's security constraint matching (which requires exact path match per Servlet spec §12.2) and RESTEasy's JAX-RS path routing (which normalizes trailing slashes), a request to /v1/enable/ bypasses the authentication constraint while still being routed to ACMEEnableService.handlePOST(). Neither ACMEEnableService nor ACMEDisableService performs application-level authorization checks — they directly call database.setEnabled(true/false). An unauthenticated remote attacker can exploit this to enable or disable ACME services, allowing persistent denial of service by repeatedly disabling the service, or re-enabling a service that was intentionally disabled by an administrator.