CVE-2026-73197

Summary

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

Affected Software

VendorProductVersion RangeStatus
Red HatRed Hat Enterprise Linux 100:4.13.4-1.el10_2 < *unaffected
Red HatRed Hat Enterprise Linux 90:4.13.4-1.el9_8 < *unaffected

Weaknesses

  • CWE-770: Allocation of Resources Without Limits or Throttling

Workarounds

If the /ipa/migration endpoint is not required, it can be disabled by commenting out or removing the Alias /ipa/migration and its corresponding &lt;Directory&gt; block in the Apache configuration file (e.g., /etc/httpd/conf.d/ipa.conf).

Alternatively, to limit the size of request bodies processed by the /ipa/migration endpoint, add the LimitRequestBody directive within the &lt;Directory &#34;/usr/share/ipa/migration&#34;&gt; block in your Apache configuration, setting a conservative limit such as 1 MiB (1048576 bytes):

&lt;Directory &#34;/usr/share/ipa/migration&#34;&gt;
    LimitRequestBody 1048576
    # ... other directives ...
&lt;/Directory&gt;

After modifying the Apache configuration, the httpd service must be reloaded or restarted for the changes to take effect. This may temporarily interrupt service.

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: yes
    • Technical Impact: partial

References