CVE-2026-73197: FreeIPA Denial of Service Vulnerability

CVE-2026-73197 Overview

CVE-2026-73197 is a denial of service vulnerability in FreeIPA, an integrated identity and authentication solution for Linux and UNIX networked environments. The flaw resides in the /ipa/migration/migration.py endpoint, which processes form POST requests without enforcing size limits. A remote, unauthenticated attacker can submit oversized request bodies that the migration handler reads fully into memory. This behavior increases memory consumption, degrades request handling performance, and can render the service unavailable. The weakness maps to [CWE-770] (Allocation of Resources Without Limits or Throttling).

Critical Impact
Unauthenticated remote attackers can exhaust FreeIPA server memory and cause service disruption by sending oversized POST requests to the migration endpoint.

Affected Products

FreeIPA (identity management server)
Red Hat Identity Management (IdM) distributions bundling FreeIPA
Deployments exposing the /ipa/migration/migration.py endpoint

Discovery Timeline

2026-08-20 - CVE-2026-73197 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73197

Vulnerability Analysis

The vulnerability affects the FreeIPA migration handler exposed at /ipa/migration/migration.py. This endpoint accepts form-encoded POST requests as part of the user migration workflow. The handler reads the full request body into memory before validating or bounding its size. An attacker can therefore submit arbitrarily large payloads that force the server to allocate memory proportional to the input.

Repeated or concurrent oversized requests amplify the effect. Memory pressure on the FreeIPA process degrades response times for legitimate authentication and directory operations. Because FreeIPA underpins Kerberos, LDAP, DNS, and certificate services in many environments, service disruption cascades to dependent applications.

Root Cause

The root cause is missing input size validation on the migration endpoint. The handler does not enforce a maximum content length before reading the POST body. This violates the resource control requirements described in [CWE-770]. Requests are accepted without authentication, removing any barrier that would otherwise limit the attacker population.

Attack Vector

An attacker with network access to the FreeIPA web interface sends a crafted HTTP POST request to /ipa/migration/migration.py. The request contains an oversized form body. The server reads the body into memory during request parsing. Repeated requests from one or more sources compound the memory footprint until the service becomes unresponsive or the host exhausts available memory. No credentials, user interaction, or prior access are required. Technical details are documented in the Red Hat CVE-2026-73197 Advisory and the Red Hat Bugzilla Entry #2474697.

Detection Methods for CVE-2026-73197

Indicators of Compromise

HTTP POST requests to /ipa/migration/migration.py with abnormally large Content-Length headers
Repeated requests to the migration endpoint from the same source IP within short intervals
Sudden growth in FreeIPA server process memory (httpd, ipa worker processes) without corresponding legitimate workload
Increased request latency or connection timeouts on the FreeIPA management interface

Detection Strategies

Monitor Apache access logs on the FreeIPA server for POST requests to /ipa/migration/migration.py with content lengths exceeding expected migration payload sizes
Alert on unauthenticated POST traffic to the migration endpoint from external or non-administrative source networks
Correlate spikes in server memory usage with concurrent requests to the migration handler

Monitoring Recommendations

Enable request size logging in the Apache configuration fronting FreeIPA to capture payload dimensions
Track memory utilization of the httpd and FreeIPA worker processes and alert on sustained increases
Feed FreeIPA and reverse proxy logs into a centralized SIEM for pattern analysis across multiple identity servers

How to Mitigate CVE-2026-73197

Immediate Actions Required

Restrict network access to the FreeIPA management interface so that only trusted administrative networks can reach /ipa/migration/migration.py
Apply vendor-supplied updates as soon as Red Hat or the FreeIPA project publishes patched packages
Disable the migration endpoint if the user migration workflow is not in active use

Patch Information

Refer to the Red Hat CVE-2026-73197 Advisory for current package versions and errata. Track the Red Hat Bugzilla Entry #2474697 for upstream fix status. Apply updates through the standard package manager (dnf update ipa-server or equivalent) once available.

Workarounds

Enforce a maximum request body size at the reverse proxy or Apache layer using LimitRequestBody for the migration endpoint
Deploy rate limiting on /ipa/migration/migration.py using mod_ratelimit or a web application firewall
Block external access to the migration URL via firewall rules or Apache Require directives when migration is not in progress

bash

# Apache configuration example: limit request body size on the migration endpoint
<Location "/ipa/migration/migration.py">
    LimitRequestBody 65536
    Require ip 10.0.0.0/8
</Location>