Dogtag-Pki Security Update — AlmaLinux 10 (ALSA-2026:92408)

ALSA-2026:92408 updates IdM PKI (Dogtag Certificate System) on AlmaLinux 10, fixing CVE-2026-89059, CVE-2026-89058 and CVE-2026-89407 — XML-parsing resource-exhaustion flaws (CWE-409) at aggregate CVSS 7.5. Relevant to IdM deployments: dnf update on the pki packages and restart the PKI services.

High 7.5 CVSS 2026-10-30

AlmaLinux 10

Was das unter einer SharedLicense-Lizenz bedeutet

The PKI components issue and verify the certificates an identity infrastructure depends on — resource-exhaustion flaws there are a denial-of-service lever against authentication and certificate operations themselves.

Type:

security

Severity:

important

Release date:

2026-10-30

Description:

IdM PKI is an enterprise software system designed to manage enterprise Public Key Infrastructure deployments. IdM PKI consists of the following components:

* Certificate Authority (CA)
* Key Recovery Authority (KRA)
* Online Certificate Status Protocol (OCSP) Manager
* Token Key Service (TKS)
* Token Processing Service (TPS)
* Automatic Certificate Management Environment (ACME) Responder
* Enrollment over Secure Transport (EST) Responder

Security Fix(es):

* resteasy-core: RESTEasy: IIOImageProvider Unbounded Image Decode (Decompression-Bomb DoS) (CVE-2026-89059)
* resteasy-core: RESTEasy: CorsFilter Reflects Arbitrary Origin with Credentials under Wildcard Config (CVE-2026-89058)
* com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking (CVE-2026-89407)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

References:

Updated packages listed below:

Architecture	Package	Checksum
aarch64	idm-pki-tools-11.9.0-6.el10_2.1.alma.1.aarch64.rpm	1a020c4c22cdfff94da872c75fe5c9dc29181fddc130b54c6e636c7e048474fa
noarch	idm-pki-server-11.9.0-6.el10_2.1.alma.1.noarch.rpm	843882d8cffb3c808c5d6e4525e8b2267546b118fac88dbc09505d024f4cee51
noarch	idm-pki-ca-11.9.0-6.el10_2.1.alma.1.noarch.rpm	b4d92ea747d625d239bd8d8364fabd2ae8e0f67fbc8eacd58c4a0261e9bb0a81
noarch	idm-pki-acme-11.9.0-6.el10_2.1.alma.1.noarch.rpm	cbbea7d6ba24c5188bbcdbddbd313857ecbd78cb0790f44b973cf21a2d83add4
noarch	idm-pki-java-11.9.0-6.el10_2.1.alma.1.noarch.rpm	de7740900d7117134ce7931d01e05ccafd8eba7ce97348c13af21d452bce014f
noarch	python3-idm-pki-11.9.0-6.el10_2.1.alma.1.noarch.rpm	ee46d34d870992b92b69fecd7f1c5f7b216089db9aad92368d0eda868930cc97
noarch	idm-pki-kra-11.9.0-6.el10_2.1.alma.1.noarch.rpm	fdd0b4c262c83d6512272f2b4ce8cb0feb01678d27c3d2582ec611bb543f05c3
noarch	idm-pki-base-11.9.0-6.el10_2.1.alma.1.noarch.rpm	fe78cb4cc44ea402030652239bcc0756eb2c2fd300eb1f32d76a3dd1189b0877
ppc64le	idm-pki-tools-11.9.0-6.el10_2.1.alma.1.ppc64le.rpm	a5029aee9fc595ad90968b122039d1b2652a51d46cec393a888346378676f2f8
s390x	idm-pki-tools-11.9.0-6.el10_2.1.alma.1.s390x.rpm	de31f21789731ea5cd234e40b44c0d6647ed22a30186a81ee7fa993c0ce4dfb9
x86_64	idm-pki-tools-11.9.0-6.el10_2.1.alma.1.x86_64.rpm	5f7b29178b8991364c294fa2bcb6548e749af589c1da177edb890084ec15c71c
x86_64_v2	idm-pki-tools-11.9.0-6.el10_2.1.alma.1.x86_64_v2.rpm	b71d19752df4712587cccc32b6bba29182c96c27bf2264c5ab7c7fe5a6e66863

Notes:

This page is generated automatically from Red Hat security data and has not been checked for errors. For clarification or corrections please contact the AlmaLinux Packaging Team.

Häufig gestellte Fragen

What is ALSA-2026:92408?

It is AlmaLinux's IdM PKI erratum for AlmaLinux 10, fixing three CVEs (CVE-2026-89059, CVE-2026-89058, CVE-2026-89407) — XML-parsing resource-exhaustion issues (CWE-409) in the Dogtag Certificate System components, aggregate CVSS 7.5.

Who is affected?

AlmaLinux 10 servers running IdM PKI components (CA, Key Recovery Authority, Online Certificate Status Protocol Manager) — typical for identity-managed enterprise environments, less common on plain hosting servers.

How do I apply the fix?

Run dnf update for the pki packages and restart the PKI instances (systemctl restart pki-tomcatd@instance or per your deployment). Verify certificate operations afterwards.

What is the impact class of these flaws?

CWE-409 — improper resource exhaustion handling: crafted requests consume unbounded resources. In a certificate authority context that means crafted enrollment or verification requests can degrade or halt certificate operations.

Referenzen

Sicherheitshinweise

System auf Schwachstellen prüfen

Wählen Sie Ihr Produkt und Betriebssystem, um die passenden Fix-Befehle zu sehen.

System prüfen

Häufig gestellte Fragen

Verwandte Warnhinweise

System auf Schwachstellen prüfen