EUVD-2026-63241
GHSA-rvf3-5qrx-mrj3
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Network-reachable OTP endpoint requires only a low-privilege account; no confidentiality or integrity impact - only partial availability degradation consistent with A:L.
Primary rating from Vendor (redhat).
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3DescriptionNVD
A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service.
AnalysisAI
Resource exhaustion in FreeIPA's OTP key processing path allows any low-privilege authenticated domain user to degrade the IPA authentication service. By submitting an oversized One-Time Password key, the user triggers an unbounded decode/re-encode cycle (CWE-770) that consumes excessive CPU and memory, degrading availability for all dependent systems and users. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid low-privilege FreeIPA domain account (confirmed by PR:L in the CVSS vector) and network connectivity to the IPA service endpoint (AV:N). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.3 score and vector AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L are internally consistent with the described behavior: network-reachable, low complexity, low-privilege, with only partial availability impact and no confidentiality or integrity consequences. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker who holds any valid FreeIPA domain credential - obtained via phishing or password spray - connects to the IPA service over HTTPS and submits a crafted request containing an abnormally large OTP key value. The IPA service accepts the input and begins an unbounded decode/re-encode operation, consuming server CPU and memory. … |
| Remediation | Apply the vendor-provided package update via standard Red Hat package management (dnf update ipa-server ipa-client or yum update on older RHEL releases), referencing the Red Hat Security Advisory at https://access.redhat.com/security/cve/CVE-2026-73196 for the exact patched package builds per RHEL version. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
HTTP request smuggling in Undertow (the embedded web server underpinning JBoss EAP, Red Hat Data Grid, and Apache Camel
HTTP request smuggling in Red Hat Undertow allows remote unauthenticated attackers to bypass front-end security controls
Out-of-bounds read in the GnuTLS DTLS handshake reassembly logic lets remote unauthenticated attackers trigger an intege
HTTP request smuggling in Undertow allows remote unauthenticated attackers to send `\r\r\r` as a header block terminator
Local privilege escalation in Performance Co-Pilot (PCP) on Red Hat Enterprise Linux 6 through 10 and OpenShift Containe
Denial of service in Red Hat / 389 Directory Server (389-ds-base, versions since ~1.3.2/2013) allows an authenticated LD
Local-to-domain-wide root privilege escalation in SSSD's LDAP sudo provider allows an authenticated LDAP directory user
Heap buffer overflow in GStreamer's librfb (RFB/VNC client) allows a malicious VNC server to corrupt heap memory on a co
Same technique Denial Of Service
View allVendor StatusVendor
SUSE
Severity: ModerateShare
External POC / Exploit Code
Leaving vuln.today