Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 4.13.4-1.el9_8
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: yes
- Technical impact: partial
Summary
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: yes · Technical impact: partial
- Record last updated
Affected versions
- ipa
Version range not reported
- ipa
Version range not reported
- ipa
Version range not reported
- idm:client
Version range not reported
- idm:DL1
Version range not reported
- idm:client
Version range not reported
- idm:DL1
Version range not reported
- idm:client
Version range not reported
- idm:DL1
Version range not reported
- idm:client
Version range not reported
- idm:DL1
Version range not reported
- idm:client
Version range not reported
- idm:DL1
Version range not reported
- ipa
Version range not reported
- ipa
Version range not reported
- ipa
Version range not reported
- ipa
Version range not reported
- ipa
Version range not reported
References 12
access.redhat.com
bugzilla.redhat.com
Questions about CVE-2026-73197
What does this mean?
The FreeIPA server's migration endpoint at /ipa/migration/migration.py reads request bodies without any size limit. An unauthenticated attacker can send very large requests to make the server denial-of-service.Source: access.redhat.com
Am I affected, and how do I check?
The advisory lists Red Hat Enterprise Linux 6, 7 (Extended Lifecycle Support), 8, 9, and 10 as affected products, including several Extended Update Support and SAP or Telecommunications variants. To check a system, look at the installed ipa package version and compare it with the fixed version 4.13.4-1.el9_8 or later.Source: access.redhat.com
What should I do about it?
Update the ipa package to 4.13.4-1.el9_8 or a later build that includes the fix for your RHEL release. No workaround is listed in the facts.Source: access.redhat.com
Is it being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data