Skip to content
Fencer Vulns
high 7.5

CVE-2026-73197 json

Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read

published 2026-08-20 2 mo ago modified 2026-11-05 4 d ago also EUVD-2026-63240

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 48%
public exploits
0
none known

Summary

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

Patch / fix

  • Red Hat Red Hat Enterprise Linux 10 0:4.13.4-1.el10_2
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support 0:4.12.2-15.el10_0.7
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support 0:4.6.8-5.el7_9.25
  • Red Hat Red Hat Enterprise Linux 8 8100020261007070536.823393f5, 8100020261007071200.143e9e98
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support 8040020261027121250.f153676a, 8040020261027121355.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On 8040020261027121250.f153676a, 8040020261027121355.5b01ab7e
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support 8060020261008133528.ada582f1, 8060020261008134123.c1533a64
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On 8060020261008133528.ada582f1, 8060020261008134123.c1533a64
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service 8080020261007071832.b0a6ceea, 8080020261007080925.e581a9e4
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions 8080020261007071832.b0a6ceea, 8080020261007080925.e581a9e4
  • Red Hat Red Hat Enterprise Linux 9 0:4.13.4-1.el9_8
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions 0:4.10.1-12.el9_2.7
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions 0:4.11.0-15.el9_4.9
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support 0:4.12.2-14.el9_6.8
  • ipa RHEL 8 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
  • pyusb RHEL 8 1.0.0-9.1.module+el8.9.0+18920+2223d05e
  • softhsm RHEL 8 2.6.0-5.module+el8.9.0+18911+94941f82
  • custodia RHEL 8 0.6.0-3.module+el8.9.0+18911+94941f82
  • slapi-nis RHEL 8 0.60.0-4.module+el8.10.0+20723+03062ebd
  • ipa-client RHEL 8 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
  • ipa-common RHEL 8 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3
  • ipa-server RHEL 8 4.9.13-21.module+el8.10.0+25041+701625f4.3

red hat advisories RHSA-2026:83460RHSA-2026:83461RHSA-2026:83085RHSA-2026:83083RHSA-2026:83084RHSA-2026:82935

  • softhsm AlmaLinux 8 2.6.0-5.module_el8.6.0+2881+2f24dc92
  • softhsm AlmaLinux 8 2.6.0-5.module_el8.6.0+3031+2f24dc92
  • custodia AlmaLinux 8 0.6.0-3.module_el8.6.0+2881+2f24dc92
  • slapi-nis AlmaLinux 8 0.60.0-4.module_el8.10.0+3844+20e075e5.alma.1
  • ipa-client AlmaLinux 8 4.9.13-21.module_el8.10.0+4302+2d2000af.3
  • ipa-common AlmaLinux 8 4.9.13-21.module_el8.10.0+4302+2d2000af.3
  • ipa-server AlmaLinux 8 4.9.13-21.module_el8.10.0+4302+2d2000af.3
  • opendnssec AlmaLinux 8 2.1.7-2.module_el8.10.0+3980+d78e8e90

almalinux advisories ALSA-2026:83460ALSA-2026:72279ALSA-2026:70564

  • ipa Rocky Linux 8 4.9.13-21.module+el8.10.0+40089+03bf3c1f
  • ipa Rocky Linux 8 4.9.13-21.module+el8.10.0+40090+e6f37a74
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1372+09f67869
  • pyusb Rocky Linux 8 1.0.0-9.1.module+el8.9.0+1371+ffa84eb9
  • softhsm Rocky Linux 8 2.6.0-5.module+el8.9.0+1371+ffa84eb9
  • custodia Rocky Linux 8 0.6.0-3.module+el8.9.0+1371+ffa84eb9
  • slapi-nis Rocky Linux 8 0.60.0-4.module+el8.9.0+1573+39ab85f4
  • opendnssec Rocky Linux 8 2.1.7-2.module+el8.10.0+1960+1ed527b3

rocky linux advisories RLSA-2026:83460RLSA-2026:72279RLSA-2026:70564

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-73197 updated cvss 7.5

ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read

  • Red Hat Enterprise Linux 6 ipa, ipa-client, ipa-python, ipa-server, ipa-admintools, ipa-server-selinux, +1 more
    affected: workaround, no fix planned “Out of support scope”
  • Red Hat CodeReady Linux Builder EUS (v.9.6) python3-ipatests 4.12.2-14.el9_6.8
    fixed: vendor fix RHSA-2026:83083
  • Red Hat Enterprise Linux AppStream (v. 8) pyusb 1.0.0-9.1.module+el8.9.0+18911+94941f82, pyusb 1.0.0-9.1.module+el8.9.0+18920+2223d05e, softhsm 2.6.0-5.module+el8.9.0+18911+94941f82, custodia 0.6.0-3.module+el8.9.0+18911+94941f82, ipa 4.9.13-21.module+el8.10.0+25041+701625f4.3, ipa 4.9.13-21.module+el8.10.0+25042+a3bddcd5.3, +50 more
    fixed: vendor fix RHSA-2026:83460
  • Red Hat Enterprise Linux AppStream (v. 9) ipa 4.13.4-1.el9_8, ipa-client 4.13.4-1.el9_8, ipa-common 4.13.4-1.el9_8, ipa-server 4.13.4-1.el9_8, ipa-selinux 4.13.4-1.el9_8, ipa-client-epn 4.13.4-1.el9_8, +12 more
    fixed: vendor fix RHSA-2026:70564
  • Red Hat Enterprise Linux AppStream (v. 10) ipa 4.13.4-1.el10_2, ipa-client 4.13.4-1.el10_2, ipa-common 4.13.4-1.el10_2, ipa-server 4.13.4-1.el10_2, ipa-selinux 4.13.4-1.el10_2, ipa-client-epn 4.13.4-1.el10_2, +12 more
    fixed: vendor fix RHSA-2026:72279
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.2-10.module+el8.4.0+25230+139d38e7.6, ipa 4.9.2-10.module+el8.4.0+25231+beff12c5.6, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:93452
  • Red Hat Enterprise Linux AppStream AUS (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.8-13.module+el8.6.0+25053+bc39327b.4, ipa 4.9.8-13.module+el8.6.0+25054+4a5dd89b.4, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:89836
  • Red Hat Enterprise Linux AppStream E4S (v.8.8) custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.9.11-11.module+el8.8.0+25043+cab6964c.6, ipa 4.9.11-11.module+el8.8.0+25045+e21657cc.6, pyusb 1.0.0-9.1.module+el8.7.0+15690+c8d45780, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:83461
show 11 more
  • Red Hat Enterprise Linux AppStream E4S (v.9.2) ipa 4.10.1-12.el9_2.7, ipa-client 4.10.1-12.el9_2.7, ipa-common 4.10.1-12.el9_2.7, ipa-server 4.10.1-12.el9_2.7, ipa-selinux 4.10.1-12.el9_2.7, ipa-client-epn 4.10.1-12.el9_2.7, +8 more
    fixed: vendor fix RHSA-2026:83085
  • Red Hat Enterprise Linux AppStream E4S (v.9.4) ipa 4.11.0-15.el9_4.9, ipa-client 4.11.0-15.el9_4.9, ipa-common 4.11.0-15.el9_4.9, ipa-server 4.11.0-15.el9_4.9, ipa-selinux 4.11.0-15.el9_4.9, ipa-client-epn 4.11.0-15.el9_4.9, +8 more
    fixed: vendor fix RHSA-2026:83084
  • Red Hat Enterprise Linux AppStream EUS (v. 10.0) ipa 4.12.2-15.el10_0.7, ipa-client 4.12.2-15.el10_0.7, ipa-common 4.12.2-15.el10_0.7, ipa-server 4.12.2-15.el10_0.7, ipa-selinux 4.12.2-15.el10_0.7, ipa-client-epn 4.12.2-15.el10_0.7, +12 more
    fixed: vendor fix RHSA-2026:82935
  • Red Hat Enterprise Linux AppStream EUS (v.9.6) ipa 4.12.2-14.el9_6.8, ipa-client 4.12.2-14.el9_6.8, ipa-common 4.12.2-14.el9_6.8, ipa-server 4.12.2-14.el9_6.8, ipa-selinux 4.12.2-14.el9_6.8, ipa-client-epn 4.12.2-14.el9_6.8, +12 more
    fixed: vendor fix RHSA-2026:83083
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.2-10.module+el8.4.0+25230+139d38e7.6, ipa 4.9.2-10.module+el8.4.0+25231+beff12c5.6, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:93452
  • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) pyusb 1.0.0-9.module+el8.1.0+4098+f286395e, pyusb 1.0.0-9.module+el8.1.0+4107+4a66eb87, ipa 4.9.8-13.module+el8.6.0+25053+bc39327b.4, ipa 4.9.8-13.module+el8.6.0+25054+4a5dd89b.4, custodia 0.6.0-3.module+el8.1.0+4098+f286395e, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:89836
  • Red Hat Enterprise Linux AppStream TUS (v.8.8) custodia 0.6.0-3.module+el8.1.0+4098+f286395e, ipa 4.9.11-11.module+el8.8.0+25043+cab6964c.6, ipa 4.9.11-11.module+el8.8.0+25045+e21657cc.6, pyusb 1.0.0-9.1.module+el8.7.0+15690+c8d45780, pyusb 1.0.0-9.1.module+el8.7.0+15691+2b2c1dd5, softhsm 2.6.0-5.module+el8.4.0+10227+076cd560, +50 more
    fixed: vendor fix RHSA-2026:83461
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 9) python3-ipatests 4.13.4-1.el9_8
    fixed: vendor fix RHSA-2026:70564
  • Red Hat Enterprise Linux CodeReady Linux Builder (v. 10) python3-ipatests 4.13.4-1.el10_2
    fixed: vendor fix RHSA-2026:72279
  • Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0) python3-ipatests 4.12.2-15.el10_0.7
    fixed: vendor fix RHSA-2026:82935
  • Red Hat Enterprise Linux Server (v. 7 ELS) ipa 4.6.8-5.el7_9.25, ipa-client 4.6.8-5.el7_9.25, ipa-common 4.6.8-5.el7_9.25, ipa-server 4.6.8-5.el7_9.25, ipa-server-dns 4.6.8-5.el7_9.25, python2-ipalib 4.6.8-5.el7_9.25, +6 more
    fixed: vendor fix RHSA-2026:93071

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.59% chance of exploitation in the next 30 days, higher than 48% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 10.0 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 7 Extended Lifecycle Support
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  • Red Hat Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On
  • Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Service
  • Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions
  • Red Hat Red Hat Enterprise Linux 9.6 Extended Update Support
  • Red Hat Red Hat Enterprise Linux 6

Classification

Weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.