EUVD-2026-63244
GHSA-p44q-gpjc-mgm9
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessIdentify internet-exposed FreeIPA HTTPS interface
-
DeliverySend HTTP POST to /ipa/i18n_messages with arbitrarily large body
-
ExploitServer allocates unbounded memory processing request
-
ExecutionHost RAM exhausted
-
PersistFreeIPA process crashes or becomes unresponsive
-
ImpactAuthentication and identity services denied to all dependent systems
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | The FreeIPA HTTPS web interface (default TCP 443) must be network-reachable by the attacker. The |
| Impact | The CVSS 7.5 score and vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately characterize a network-reachable, zero-authentication DoS with no complexity barrier. EPSS data was not provided in the input, so exploitation probability cannot be quantified from that signal; this gap should be monitored as EPSS coverage expands. There is no CISA KEV listing and no public POC has been identified, which reduces urgency relative to actively exploited issues. However, the attack is trivially automatable - a single oversized HTTP POST to a well-known, documented public endpoint is sufficient to trigger memory exhaustion - which elevates real-world risk beyond what an availability-only CVSS score might suggest in isolation. Impact is confined to availability (A:H); there is no confidentiality or integrity exposure, and scope is unchanged (S:U), meaning the flaw cannot be used as a pivot to other systems directly. Organizations should prioritize remediation when FreeIPA is internet-exposed, since identity service disruption cascades to all Kerberos and LDAP-dependent authentication workflows across the enterprise. SSVC signals: exploitation status unconfirmed, attack is automatable, technical impact is partial (availability only). |
| Exploit ScenarioDerived | An unauthenticated attacker with network access to the FreeIPA HTTPS interface sends a crafted HTTP POST request containing a multi-gigabyte body to the |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 20, 2026
Memory exhaustion in FreeIPA's /ipa/i18n_messages endpoint allows a remote, unauthenticated attacker to crash identity services by sending an arbitrarily large HTTP request body. All RHEL-bundled FreeIPA deployments across RHEL 6 through RHEL 10 are affected per Red Hat CPE data. No active exploitation is confirmed (not in CISA KEV) and no public exploit code has been identified at time of analysis, but the attack requires no authentication and no special configuration, making every internet-exposed FreeIPA instance a plausible target.
RemediationAI
Apply the Red Hat-issued errata for FreeIPA as published at https://access.redhat.com/security/cve/CVE-2026-73198. No exact patched FreeIPA package version is confirmed in the available input data - the specific fix version must be verified via the Red Hat Customer Portal errata and Bugzilla ticket 2472960 before deployment. As a compensating control pending patching, restrict network access to the FreeIPA web interface (TCP 443 and 80) to trusted internal networks or VPN ranges using host firewall rules (firewalld rich rules or iptables); this prevents unauthenticated internet-sourced exploitation at the cost of blocking legitimate remote access. An additional mitigation is placing a reverse proxy (e.g., nginx with client_max_body_size set to a conservative limit such as 1m) in front of the FreeIPA HTTPD process; this caps request body size at the proxy layer without requiring the application patch, though the appropriate limit must be tested against legitimate FreeIPA API payloads to avoid disrupting valid operations.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
FreeIPA is Red Hat's integrated identity management solution bundled with RHEL, providing centralized Kerberos authentication, LDAP directory services, DNS, and a certificate authority via a web API. The /ipa/i18n_messages endpoint handles internationalization string lookups for the web UI. The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling): the endpoint imposes no maximum size constraint on inbound HTTP request bodies, so the server-side processing layer allocates memory proportional to the attacker-controlled payload size without bound. CPE data confirms the flaw spans cpe:2.3:a:red_hat:red_hat_enterprise_linux_6 through red_hat_enterprise_linux_10 - the full supported RHEL product line. The CVSS vector (AV:N/AC:L/PR:N/UI:N) is consistent with a default-accessible web endpoint with no authentication gate.
Know when Red Hat Enterprise Linux 10 gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Endpoint is network-accessible with no authentication gate, no complexity barrier, and impact is availability-only with no confidentiality or integrity effect, matching PR:N and C:N/I:N/A:H.
Primary rating from Vendor (redhat).
CVSS VectorVendor: redhat
DescriptionCVE.org
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the /ipa/i18n_messages endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.
Executive ViewAI
FreeIPA identity services across RHEL 6-10 deployments are vulnerable to remote denial-of-service attacks via memory exhaustion in the /ipa/i18n_messages endpoint, requiring no authentication or special configuration. Any internet-facing FreeIPA instance is a plausible target; successful exploitation crashes identity services and disrupts user authentication and access control across dependent systems. Without an available patch, mitigation and monitoring are the only immediate defenses.
Network segmentation restricting FreeIPA access to trusted networks only; Web Application Firewall (WAF) rules blocking requests larger than 1 MB to the /ipa/i18n_messages endpoint; reverse proxy or web server request size limits enforced at the entry point; continuous monitoring and alerting on anomalous request patterns to this endpoint.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Red Hat Enterprise Linux 10
View allHeap corruption via double-free in 389-ds-base's LDAP control parsing allows an unauthenticated remote attacker to crash
Remote code execution in Cockpit's web interface allows unauthenticated attackers to execute arbitrary commands on the h
Remote code execution in Samba's printing subsystem allows remote attackers to inject arbitrary shell commands via craft
Ghostscript can execute arbitrary shell commands with the privileges of its process when it renders a crafted PostScript
Use-after-free in librsvg during rendering of crafted SVG documents with nested XInclude directives and duplicate entity
A signed integer overflow vulnerability exists in the libtiff library's putcontig8bitYCbCr44tile function that leads to
The system CA trust store shipped in Red Hat's ca-certificates RPM packages includes eMudhra root authorities that signe
Authentication bypass in 389 Directory Server (shipped as Red Hat Directory Server 11-13 and within RHEL 6-10) lets remo
Remote code execution and privilege escalation in HPLIP (HP Linux Imaging and Printing) affects the hpcups print filter
Unauthenticated privilege escalation in FreeIPA (Red Hat Identity Management) allows a remote attacker to gain genuine a
A heap buffer overflow exists in libsoup's WebSocket permessage-deflate compression path: when a very large outbound mes
Remote code execution in libarchive on 32-bit systems allows unauthenticated attackers to execute arbitrary code via spe
Exploit-DB