CVE-2026-73198

The vulnerability in FreeIPA allows a remote, unauthenticated attacker to send an arbitrarily large request body to the `/ipa/i18n_messages` endpoint. The server reads the entire payload before processing, which can cause the process to consume excessive amounts of memory. This leads to memory exhaustion, degraded responsiveness, and eventual service‑level denial of service. The flaw is categorized as an unbounded input resource consumption weakness (CWE‑770).

Affected systems include Red Hat Enterprise Linux 6 through 10 when the FreeIPA services are installed and active. The vulnerability exists in the FreeIPA web application layer that runs within an Apache HTTP Server instance on those operating systems. Any deployment that exposes the `/ipa/i18n_messages` endpoint to external networks is susceptible.

The CVSS score of 7.5 indicates a high‑severity impact, and while the EPSS score is not available, it is inferred that exploitation is plausible for unauthenticated attackers by simply sending a large POST request. The vendor's update status is not stated; the issue remains in the CISA KEV catalogue as not listed, but system administrators should be alerted to the potential for service disruption. The likely attack vector is a remote client sending an oversized request body to the exposed `/ipa/i18n_messages` endpoint. Based on the description, it is inferred that no authentication or privileged access is required to trigger memory exhaustion and the resulting denial of service.