Red HatCVE-2026-73197
Red Hat FreeIPA. A remote: denial of service
High7.5CVE-2026-73197 · Published Aug 20, 2026 · updated Sep 24, 2026
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 10 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 6 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 7 Product | all versions | No fix yet |
| Red Hat Enterprise Linux 8 Product | all versions | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Severity from
- the vendor (its own CVE record or advisory)
- Weakness
- CWE-770
More Red Hat advisories
All Red Hat| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Aug 20 | Red Hat multicloud-operators-subscription: information disclosure | High7.7 | No fix yet |
| Aug 20 | A flaw was found in the multicloud-operators-subscription component | Critical9.9 | No fix yet |
| Aug 20 | Red Hat Advanced Cluster Management for Kubernetes 2: information disclosure | Low2.5 | No fix yet |
| Aug 20 | Red Hat lighthouse: information disclosure | Medium5.4 | No fix yet |
| Aug 20 | Red Hat Lighthouse. A remote attacker: privilege escalation | Low3.7 | No fix yet |
| Aug 20 | A flaw was found in Kata Containers | High8.1 | No fix yet |