A flaw in FreeIPA’s migration handler allows an attacker to send oversized form POST requests to the /ipa/migration/migration.py endpoint. The handler reads the entire request body into memory without bounds, an unbounded memory allocation that can burn server resources, slow down request processing, and eventually make the service unavailable. The weakness is identified as CWE-770, Unbounded Memory Allocation. The likely attack vector is an unauthenticated HTTP POST request to the mentioned endpoint, which the remote attacker can control without credentials.

FreeIPA packages bundled with Red Hat Enterprise Linux 6, 7, 8, 9, and 10 contain the vulnerable migration service accessed at /ipa/migration. The issue affects all releases of these operating systems where FreeIPA is installed and the migration feature is enabled.

The CVSS base score of 7.5 indicates a high‑severity impact. Exploitation requires only network access to send unauthenticated HTTP requests no authentication is needed. EPSS data is not available and the vulnerability is not in the CISA KEV catalog, yet the nature of an unbounded request body suggests a high likelihood of denial‑of‑service exploitation if no mitigations are applied.