EUVD-2026-63240
GHSA-m6vw-rcwj-pg9q
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify reachable FreeIPA HTTPS port
-
DeliveryCraft oversized multipart POST body
-
ExploitSend to /ipa/migration/migration.py
-
ExecutionHandler buffers full payload in memory
-
PersistRepeat concurrently to exhaust RAM
-
ImpactFreeIPA API becomes unresponsive
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The FreeIPA HTTPS service (typically port 443) must be reachable by the attacker - no authentication, user interaction, or special session state is required, as confirmed by CVSS PR:N/UI:N. The |
| Impact | The CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model: network-reachable, low-complexity, no authentication needed, with high availability impact. This is a straightforward unauthenticated DoS targeting a critical identity management service - disrupting FreeIPA means disrupting Kerberos authentication and LDAP for all integrated Linux hosts, potentially cascading to broad service unavailability. No EPSS score was provided in the input; no KEV listing and no public POC are indicated, suggesting exploitation has not been observed in the wild at time of analysis. Despite the absence of in-the-wild exploitation, the trivial exploitation complexity (simply sending a large POST body) means low-sophistication actors could operationalize this quickly once aware. The Availability:H impact on an identity provider amplifies the blast radius significantly beyond a single host. This warrants prompt patching in internet-exposed or perimeter-adjacent deployments. |
| Exploit ScenarioDerived | An attacker with network access to the FreeIPA server's HTTPS port crafts a multipart/form POST request with an arbitrarily large body (e.g., hundreds of megabytes) directed at |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
FreeIPA's migration endpoint on Red Hat Enterprise Linux 6 through 10 is exploitable by remote unauthenticated attackers who send oversized HTTP POST requests to /ipa/migration/migration.py, causing the server to buffer arbitrarily large request bodies fully into memory. This resource exhaustion (CWE-770) leads to degraded performance, memory pressure, and potential service disruption of the identity management service. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog.
RemediationAI
Consult the Red Hat security advisory at https://access.redhat.com/security/cve/CVE-2026-73197 for updated FreeIPA packages; no specific fixed-version number was present in the available data, so the exact patched package version should be confirmed directly from the advisory before deployment. Apply available errata via dnf update ipa-server on affected RHEL systems. As a compensating control while awaiting a patch, restrict access to the /ipa/migration/migration.py endpoint at the Apache HTTPD or network perimeter layer - if the migration feature is not actively in use, disabling it via FreeIPA configuration (ipa config-mod --enable-migration=FALSE) eliminates the attack surface entirely with no operational impact on day-to-day authentication services. Additionally, deploying HTTP request body size limits at an upstream load balancer or WAF (e.g., nginx client_max_body_size) can cap the memory amplification factor even if the endpoint remains open.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreeIPA is an integrated identity and authentication solution for Linux/UNIX environments, bundling 389-DS LDAP, Kerberos, Dogtag PKI, and Apache HTTPD with a Python-based web API. The vulnerable endpoint /ipa/migration/migration.py is the migration handler responsible for facilitating LDAP-to-FreeIPA user migration flows. CWE-770 (Allocation of Resources Without Limits or Throttling) identifies the root cause: the handler performs no server-side request body size validation or limits before reading the full POST payload into memory, making it trivially abusable as a memory amplification vector. The CPE data identifies affected products as FreeIPA as shipped in cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through cpe:2.3:a:red_hat:red_hat_enterprise_linux_10.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-accessible endpoint requires no authentication or user interaction; impact is purely availability via resource exhaustion, with no confidentiality or integrity compromise.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the /ipa/migration/migration.py endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
Executive ViewAI
FreeIPA, a critical identity and access management service deployed across Red Hat Enterprise Linux 6-10, contains a resource exhaustion vulnerability allowing unauthenticated remote attackers to overwhelm the migration service and disrupt authentication availability. An adversary can send oversized HTTP POST requests to exhaust server memory, degrading performance and blocking legitimate user access across all dependent systems. Organizations running affected FreeIPA versions face immediate risk to organizational continuity and should implement protective controls within 24 hours.
No vendor-released patch identified at time of analysis. Implement interim mitigations: (1) Web Application Firewall with payload size limits on the migration endpoint; (2) Network-level rate limiting for /ipa/migration/migration.py; (3) Continuous monitoring of FreeIPA service memory and CPU utilization with automated anomaly alerting; (4) Restrict network access to the migration endpoint to authorized administrative networks only; (5) Subscribe to Red Hat security advisories for patch availability. These controls significantly reduce exploitability but do not fully eliminate risk pending vendor patch availability.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Exploit-DB