CVE-2026-73198: FreeIPA Denial of Service Vulnerability

CVE-2026-73198 Overview

A flaw in FreeIPA allows a remote, unauthenticated attacker to trigger memory exhaustion in the identity management service. The vulnerability resides in the /ipa/i18n_messages endpoint, which accepts arbitrarily large request bodies without size enforcement. Sending oversized payloads forces the service to allocate excessive memory, degrading responsiveness and producing a denial-of-service (DoS) condition. The weakness maps to [CWE-770] (Allocation of Resources Without Limits or Throttling). Because FreeIPA underpins authentication, Kerberos, and directory services in many Linux environments, an outage on this component can cascade to dependent applications.

Critical Impact
Unauthenticated attackers can exhaust server memory over the network and disrupt FreeIPA-backed authentication and directory services.

Affected Products

FreeIPA (identity management server)
Red Hat Identity Management distributions bundling the affected FreeIPA /ipa/i18n_messages endpoint
Downstream Linux distributions packaging vulnerable FreeIPA builds

Discovery Timeline

2026-08-20 - CVE-2026-73198 published to NVD
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73198

Vulnerability Analysis

The defect exists in the FreeIPA web interface handler for /ipa/i18n_messages. The endpoint returns localized message catalogs used by the FreeIPA web UI and does not require authentication to service requests. The handler parses the incoming request body without enforcing an upper bound on size. An attacker who sends a very large POST body forces the service process to allocate memory proportional to the request length. Repeated or concurrent requests amplify allocation until the FreeIPA process, or the host, exhausts available memory.

Exploitation requires only network reachability to the FreeIPA HTTPS listener. The attacker needs no credentials, no user interaction, and no prior foothold. Impact is limited to availability; confidentiality and integrity are not affected. Because FreeIPA typically fronts Kerberos, LDAP, DNS, and certificate services, a DoS against the web tier can indirectly disrupt authentication flows and management operations for dependent hosts.

Root Cause

The root cause is missing input size validation on an unauthenticated HTTP endpoint. The /ipa/i18n_messages handler accepts and processes request bodies of arbitrary length, allowing an external caller to control server-side memory allocation. This is a classic uncontrolled resource consumption pattern under [CWE-770].

Attack Vector

The attack vector is network-based against the FreeIPA HTTPS service. An attacker crafts HTTP POST requests to /ipa/i18n_messages containing large bodies, then issues them individually or in parallel until the server saturates memory. See the Red Hat CVE-2026-73198 Advisory and Red Hat Bug Report #2472960 for vendor analysis.

No verified proof-of-concept code is published. Refer to the Red Hat advisory for technical details.

Detection Methods for CVE-2026-73198

Indicators of Compromise

Unusually large HTTP POST requests to /ipa/i18n_messages from external or unexpected source addresses.
FreeIPA httpd or ipa-server processes showing rapid Resident Set Size (RSS) growth followed by out-of-memory (OOM) kills in /var/log/messages or journalctl.
Spikes in 5xx responses or connection timeouts from the FreeIPA web tier without a corresponding change in legitimate user activity.

Detection Strategies

Alert on HTTP request bodies to /ipa/i18n_messages exceeding a defined byte threshold at the reverse proxy or WAF layer.
Correlate FreeIPA process memory consumption with request rates to the i18n_messages endpoint over sliding windows.
Monitor kernel OOM killer events targeting httpd, ipa, or mod_wsgi workers on identity management hosts.

Monitoring Recommendations

Ingest FreeIPA httpd access and error logs into a centralized SIEM for correlation across identity servers.
Track baseline request sizes and rates for /ipa/i18n_messages and alert on statistical deviations.
Monitor availability of Kerberos, LDAP, and web UI endpoints to detect downstream impact from a memory exhaustion event.

How to Mitigate CVE-2026-73198

Immediate Actions Required

Apply vendor-supplied FreeIPA updates as soon as Red Hat and downstream distributions publish fixed packages.
Restrict network exposure of the FreeIPA web interface to trusted management networks using firewall rules or security groups.
Deploy a reverse proxy or WAF in front of FreeIPA to enforce request body size limits on /ipa/i18n_messages.

Patch Information

Consult the Red Hat CVE-2026-73198 Advisory for fixed package versions and errata. Track the associated Red Hat Bug Report #2472960 for upstream FreeIPA patch status.

Workarounds

Cap request body size in the fronting Apache httpd configuration using LimitRequestBody for the /ipa/i18n_messages location.
Apply rate limiting per source IP for unauthenticated FreeIPA endpoints at the network edge.
Constrain FreeIPA service memory using systemd resource controls such as MemoryMax to bound worst-case impact.

bash

# Apache httpd example: cap request bodies for the i18n_messages endpoint
<Location "/ipa/i18n_messages">
    LimitRequestBody 65536
</Location>

# systemd override to bound FreeIPA httpd memory
# /etc/systemd/system/httpd.service.d/memory.conf
[Service]
MemoryMax=2G