high7.5
CVE-2026-73197
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by...
Impact
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Redhat | Enterprise Linux | Versions 6.0, 7.0, 8.0, 9.0, 10.0 |
| Freeipa | Freeipa | before 4.13.3 |
| Red Hat | Red Hat Enterprise Linux 10 | All versions Version patch: 0:4.13.4-1.el10_2 |
| Red Hat | Red Hat Enterprise Linux 10.0 Extended Update Support | All versions Version patch: 0:4.12.2-15.el10_0.7 |
| Red Hat | Red Hat Enterprise Linux 7 Extended Lifecycle Support | All versions |
| Red Hat | Red Hat Enterprise Linux 8 | All versions Versions patch: 8100020261007070536.823393f5, patch: 8100020261007071200.143e9e98 |
| Red Hat | Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support | All versions Versions patch: 8040020261027121250.f153676a, patch: 8040020261027121355.5b01ab7e |
| Red Hat | Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On | All versions Versions patch: 8040020261027121355.5b01ab7e, patch: 8040020261027121250.f153676a |
| Red Hat | Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support | All versions Versions patch: 8060020261008133528.ada582f1, patch: 8060020261008134123.c1533a64 |
| Red Hat | Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On | All versions Versions patch: 8060020261008133528.ada582f1, patch: 8060020261008134123.c1533a64 |
| Red Hat | Red Hat Enterprise Linux 9 | Version patch: 0:4.13.4-1.el9_8 |
| Red Hat | Red Hat Enterprise Linux 8.8 Telecommunications Update Service | Versions patch: 8080020261007080925.e581a9e4, patch: 8080020261007071832.b0a6ceea |
| Red Hat | Red Hat Enterprise Linux 9.4 Update Services For SAP Solutions | Version patch: 0:4.11.0-15.el9_4.9 |
| Red Hat | Red Hat Enterprise Linux 9.6 Extended Update Support | Version patch: 0:4.12.2-14.el9_6.8 |
| Red Hat | Red Hat Enterprise Linux 9.2 Update Services For SAP Solutions | Version patch: 0:4.10.1-12.el9_2.7 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://access.redhat.com/errata/RHSA-2026:70564
- https://access.redhat.com/errata/RHSA-2026:72279
- https://access.redhat.com/errata/RHSA-2026:82935
- https://access.redhat.com/errata/RHSA-2026:83083
- https://access.redhat.com/errata/RHSA-2026:83084
- https://access.redhat.com/errata/RHSA-2026:83085
- https://access.redhat.com/errata/RHSA-2026:83460
- https://access.redhat.com/errata/RHSA-2026:83461
- https://access.redhat.com/errata/RHSA-2026:89836
- https://access.redhat.com/errata/RHSA-2026:93071
- https://access.redhat.com/security/cve/CVE-2026-73197
- https://bugzilla.redhat.com/show_bug.cgi?id=2474697
- https://access.redhat.com/errata/RHSA-2026:93452
- https://github.com/advisories/GHSA-m6vw-rcwj-pg9q
- https://nvd.nist.gov/vuln/detail/CVE-2026-73197