CVE-2026-73197

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

View on CVE.org
Published Aug 20, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Description
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

Analysis

AI-generated

Technical impact

A flaw in FreeIPA’s migration handler allows an attacker to send oversized form POST requests to the /ipa/migration/migration.py endpoint. The handler reads the entire request body into memory without bounds, an unbounded memory allocation that can burn server resources, slow down request processing, and eventually make the service unavailable. The weakness is identified as CWE-770, Unbounded Memory Allocation. The likely attack vector is an unauthenticated HTTP POST request to the mentioned endpoint, which the remote attacker can control without credentials.

Affected Systems

FreeIPA packages bundled with Red Hat Enterprise Linux 6, 7, 8, 9, and 10 contain the vulnerable migration service accessed at /ipa/migration. The issue affects all releases of these operating systems where FreeIPA is installed and the migration feature is enabled.

Risk and Exploitability

The CVSS base score of 7.5 indicates a high‑severity impact. Exploitation requires only network access to send unauthenticated HTTP requests no authentication is needed. EPSS data is not available and the vulnerability is not in the CISA KEV catalog, yet the nature of an unbounded request body suggests a high likelihood of denial‑of‑service exploitation if no mitigations are applied.

Remediation

Vendor Workaround

If the `/ipa/migration` endpoint is not required, it can be disabled by commenting out or removing the `Alias /ipa/migration` and its corresponding `<Directory>` block in the Apache configuration file (e.g., `/etc/httpd/conf.d/ipa.conf`). Alternatively, to limit the size of request bodies processed by the `/ipa/migration` endpoint, add the `LimitRequestBody` directive within the `<Directory "/usr/share/ipa/migration">` block in your Apache configuration, setting a conservative limit such as 1 MiB (1048576 bytes): ```apache <Directory "/usr/share/ipa/migration"> LimitRequestBody 1048576 # ... other directives ... </Directory> ``` After modifying the Apache configuration, the `httpd` service must be reloaded or restarted for the changes to take effect. This may temporarily interrupt service.

OpenCVE Recommended Actions

  • Apply any available Red Hat security update that patches the memory allocation flaw in FreeIPA
  • If the migration service is not required, disable it by commenting out or removing the Alias /ipa/migration and its <Directory> block in /etc/httpd/conf.d/ipa.conf
  • To limit request body size, configure Apache by adding a LimitRequestBody 1048576 directive inside the <Directory "/usr/share/ipa/migration"> block
  • Reload or restart the httpd service so the configuration changes take effect

Generated by OpenCVE AI on August 20, 2026 at 22:50 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories available
History
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:6 cpe:/o:redhat:rhel_els:6
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_aus:8.4::appstream
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream
References
Type Values Removed Values Added
First Time appeared Redhat rhel Els
CPEs cpe:/o:redhat:enterprise_linux:7 cpe:/o:redhat:rhel_els:7
Vendors & Products Redhat rhel Els
References
Type Values Removed Values Added
First Time appeared Redhat rhel Aus
Redhat rhel Eus Long Life
CPEs cpe:/a:redhat:rhel_aus:8.6::appstream
cpe:/a:redhat:rhel_eus_long_life:8.6::appstream
Vendors & Products Redhat rhel Aus
Redhat rhel Eus Long Life
References
Type Values Removed Values Added
First Time appeared Redhat rhel Tus
CPEs cpe:/o:redhat:enterprise_linux:8 cpe:/a:redhat:enterprise_linux:8::appstream
cpe:/a:redhat:rhel_e4s:8.8::appstream
cpe:/a:redhat:rhel_tus:8.8::appstream
Vendors & Products Redhat rhel Tus
References
Type Values Removed Values Added
CPEs cpe:/a:redhat:rhel_e4s:9.4::appstream
References
Type Values Removed Values Added
First Time appeared Redhat rhel E4s
Redhat rhel Eus
CPEs cpe:/a:redhat:rhel_e4s:9.2::appstream
cpe:/a:redhat:rhel_eus:9.6::appstream
cpe:/a:redhat:rhel_eus:9.6::crb
Vendors & Products Redhat rhel E4s
Redhat rhel Eus
References
Type Values Removed Values Added
First Time appeared Redhat enterprise Linux Eus
CPEs cpe:/o:redhat:enterprise_linux_eus:10.0
Vendors & Products Redhat enterprise Linux Eus
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:10 cpe:/o:redhat:enterprise_linux:10.2
References
Type Values Removed Values Added
CPEs cpe:/o:redhat:enterprise_linux:9 cpe:/a:redhat:enterprise_linux:9::appstream
cpe:/a:redhat:enterprise_linux:9::crb
References
Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}
Type Values Removed Values Added
First Time appeared Freeipa
Freeipa freeipa
CPEs cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:8.0:*:*:*:*:*:*:*
cpe:2.3:o:redhat:enterprise_linux:9.0:*:*:*:*:*:*:*
Vendors & Products Freeipa
Freeipa freeipa
Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important
Type Values Removed Values Added
Description A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
Title Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
First Time appeared Redhat
Redhat enterprise Linux
Weaknesses CWE-770
CPEs cpe:/o:redhat:enterprise_linux:10
cpe:/o:redhat:enterprise_linux:6
cpe:/o:redhat:enterprise_linux:7
cpe:/o:redhat:enterprise_linux:8
cpe:/o:redhat:enterprise_linux:9
Vendors & Products Redhat
Redhat enterprise Linux
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
Earlier changes (9)
Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Nov 4, 2026, 11:16 PM
Reserved
Aug 11, 2026, 12:49 PM

View source JSON

Updated
Aug 25, 2026, 2:25 PM

JSON

Status
Modified
Published
Aug 20, 2026, 11:16 AM
Modified
Nov 5, 2026, 12:17 AM

View source JSON

Severity
Important
Public date
Aug 20, 2026, 10:05 AM

View source Bugzilla JSON

Updated
Aug 21, 2026, 9:15 PM

JSON