Denial of Service Vulnerability in FreeIPA Migration Handler

CVE-2026-73197 is a high-severity vulnerability discovered in FreeIPA, specifically impacting the /ipa/migration/migration.py endpoint. An unauthenticated remote attacker can exploit this flaw by sending specially crafted, oversized form POST requests to the migration handler.

The vulnerability stems from improper resource management (CWE-770: Allocation of Resources Without Limits or Throttling), where the application attempts to read the entire attacker-controlled request body into memory without applying limits. Successive or large concurrent requests of this nature result in significant memory consumption, degrading request processing performance, and eventually leading to a complete service disruption or denial-of-service (DoS) state. This affects various Red Hat Enterprise Linux versions where the FreeIPA package is deployed. Defenders should prioritize limiting request body sizes or applying rate-limiting/WAF rules to the affected migration endpoint.

Impact

Successful exploitation results in a denial-of-service condition, rendering the FreeIPA service unavailable to legitimate users. This impacts authentication and identity management services across organizations relying on FreeIPA for directory and PKI services.

Recommendation

• Apply vendor-supplied patches for the FreeIPA package as released by Red Hat.
• Implement request body size limits on web application firewalls (WAF) or reverse proxies (such as Apache or Nginx) protecting the /ipa/migration/migration.py URI.
• Monitor web server access logs for anomalous, high-frequency, or large-payload POST requests directed at the migration endpoint.