CVE-2026-73197
Received Received - Intake

Remote DoS via Form POST in FreeIPA

Publication date: 2026-08-20

Last updated on: 2026-08-20

Assigner: redhat-SADP

Description
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-20
Last Modified
2026-08-20
Generated
2026-08-20
AI Q&A
2026-08-20
EPSS Evaluated
N/A
NVD
CVE-2026-73197
EUVD
EUVD-2026-63240

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
redhat freeipa 4.13.1-3.el10

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in FreeIPA allows a remote attacker to send oversized form POST requests to the /ipa/migration/migration.py endpoint without authentication. The migration handler reads the entire request body into memory based on the CONTENT_LENGTH header, causing high memory usage, slower performance, and potential service disruption or denial of service.

Detection Guidance

Monitor for unusually large POST requests to /ipa/migration/migration.py or increased memory usage in FreeIPA services. Check Apache logs for requests exceeding typical size limits.

Impact Analysis

An attacker could exploit this to consume excessive server memory, slow down or crash the FreeIPA service, and disrupt normal operations. This could affect authentication, identity management, and other services relying on FreeIPA, especially if the migration endpoint is exposed to untrusted networks.

Compliance Impact

This vulnerability primarily impacts availability, which could lead to service disruptions. While it does not directly cause data breaches, prolonged downtime may violate availability requirements in GDPR, HIPAA, or other regulations mandating timely access to critical systems. Ensuring service uptime is essential for compliance.

Mitigation Strategies
  • Disable the /ipa/migration endpoint by removing its Apache configuration entries.
  • Set LimitRequestBody to 1 MiB in Apache configuration to restrict request sizes.
  • Restart the httpd service after making changes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-73197. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart