High
Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
Type: advisorySources: Official CVE List
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
- Products
- Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support, Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On, Red Hat Enterprise Linux 8.8 Telecommunications Update Service, Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions, Red Hat Enterprise Linux 9.6 Extended Update Support
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2026-73197
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 08:57 UTC · Revision 2
Source evidence
Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
core-cve · Original sourcePublished 20 Aug 2026, 10:31 UTC
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
cve:CVE-2026-73197
Red Hat Enterprise Linux 10
Fixed versions: Not specified
Red Hat Enterprise Linux 10.0 Extended Update Support
Fixed versions: Not specified
Red Hat Enterprise Linux 8
Fixed versions: Not specified
Red Hat Enterprise Linux 8
Fixed versions: Not specified
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Fixed versions: Not specified
Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
Fixed versions: Not specified
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Fixed versions: Not specified
Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
Fixed versions: Not specified
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Fixed versions: Not specified
Red Hat Enterprise Linux 8.8 Telecommunications Update Service
Fixed versions: Not specified
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Fixed versions: Not specified
Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
Fixed versions: Not specified
Red Hat Enterprise Linux 9
Fixed versions: Not specified
Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
Fixed versions: Not specified
Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
Fixed versions: Not specified
Red Hat Enterprise Linux 9.6 Extended Update Support
Fixed versions: Not specified
Red Hat Enterprise Linux 6
Fixed versions: Not specified
Red Hat Enterprise Linux 7
Fixed versions: Not specified
Complete source record
{
"id": "112ccb8653be481959ce428a5bb086a20a953ce264f315bc120b04db318e40fc",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-73197",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read",
"summary": "A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.",
"evidence": "cve:CVE-2026-73197",
"products": [
{
"name": {
"value": "Red Hat Enterprise Linux 10",
"evidence": "/containers/cna/affected/0/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"evidence": "/containers/cna/affected/1/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8",
"evidence": "/containers/cna/affected/2/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8",
"evidence": "/containers/cna/affected/3/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"evidence": "/containers/cna/affected/4/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"evidence": "/containers/cna/affected/5/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"evidence": "/containers/cna/affected/6/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"evidence": "/containers/cna/affected/7/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"evidence": "/containers/cna/affected/8/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"evidence": "/containers/cna/affected/9/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"evidence": "/containers/cna/affected/10/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"evidence": "/containers/cna/affected/11/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 9",
"evidence": "/containers/cna/affected/12/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"evidence": "/containers/cna/affected/13/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"evidence": "/containers/cna/affected/14/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"evidence": "/containers/cna/affected/15/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 6",
"evidence": "/containers/cna/affected/16/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
},
{
"name": {
"value": "Red Hat Enterprise Linux 7",
"evidence": "/containers/cna/affected/17/product"
},
"prerequisites": [],
"fixed_versions": [],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-73197",
"aliases": [
"CVE-2026-73197"
],
"metrics": [
{
"other": {
"type": "Red Hat severity rating",
"content": {
"value": "Important",
"namespace": "https://access.redhat.com/security/updates/classification/"
}
}
},
{
"format": "CVSS",
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.5,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
}
}
],
"affected": [
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:10.2"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10",
"versions": [
{
"status": "unaffected",
"version": "0:4.13.4-1.el10_2",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux_eus:10.0"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:4.12.2-15.el10_0.7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "8100020261007071200.143e9e98",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8",
"versions": [
{
"status": "unaffected",
"version": "8100020261007070536.823393f5",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "8060020261008134123.c1533a64",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support",
"versions": [
{
"status": "unaffected",
"version": "8060020261008133528.ada582f1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "8060020261008134123.c1533a64",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_aus:8.6::appstream",
"cpe:/a:redhat:rhel_eus_long_life:8.6::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On",
"versions": [
{
"status": "unaffected",
"version": "8060020261008133528.ada582f1",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "8080020261007080925.e581a9e4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Telecommunications Update Service",
"versions": [
{
"status": "unaffected",
"version": "8080020261007071832.b0a6ceea",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "8080020261007080925.e581a9e4",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:client",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:8.8::appstream",
"cpe:/a:redhat:rhel_tus:8.8::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "8080020261007071832.b0a6ceea",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "idm:DL1",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/a:redhat:enterprise_linux:9::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"versions": [
{
"status": "unaffected",
"version": "0:4.13.4-1.el9_8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.2::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:4.10.1-12.el9_2.7",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_e4s:9.4::appstream"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions",
"versions": [
{
"status": "unaffected",
"version": "0:4.11.0-15.el9_4.9",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/a:redhat:rhel_eus:9.6::appstream",
"cpe:/a:redhat:rhel_eus:9.6::crb"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9.6 Extended Update Support",
"versions": [
{
"status": "unaffected",
"version": "0:4.12.2-14.el9_6.8",
"lessThan": "*",
"versionType": "rpm"
}
],
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:6"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 6",
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "unknown"
},
{
"cpes": [
"cpe:/o:redhat:enterprise_linux:7"
],
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 7",
"packageName": "ipa",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"defaultStatus": "affected"
}
],
"modified": "2026-10-26T13:26:58.629Z",
"provider": "cve",
"references": [
"https://access.redhat.com/errata/RHSA-2026:70564",
"https://access.redhat.com/errata/RHSA-2026:72279",
"https://access.redhat.com/errata/RHSA-2026:82935",
"https://access.redhat.com/errata/RHSA-2026:83083",
"https://access.redhat.com/errata/RHSA-2026:83084",
"https://access.redhat.com/errata/RHSA-2026:83085",
"https://access.redhat.com/errata/RHSA-2026:83460",
"https://access.redhat.com/errata/RHSA-2026:83461",
"https://access.redhat.com/errata/RHSA-2026:89836",
"https://access.redhat.com/security/cve/CVE-2026-73197",
"https://bugzilla.redhat.com/show_bug.cgi?id=2474697"
],
"provider_metadata": {
"adp": [
{
"title": "CISA ADP Vulnrichment",
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"id": "CVE-2026-73197",
"role": "CISA Coordinator",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"version": "2.0.3",
"timestamp": "2026-08-25T14:25:03.526898Z"
}
}
}
],
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-08-25T14:25:16.305Z"
}
}
],
"cna": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-10-26T13:26:58.629Z"
}
}
},
"related_cves": [
{
"value": "CVE-2026-73197",
"evidence": "/cveMetadata/cveId"
}
],
"security_relevant": true,
"severity_evidence": "/containers/cna/metrics"
},
"source_id": "core-cve",
"document_id": 307218,
"published_at": "2026-08-20T10:31:31.674+00:00"
}