CVE-2026-73197
High
Description
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Freeipa
PublishedAug 20, 2026
First seenAug 20, 2026
Weakness typeCWE-770Allocation of resources without limits
How to fix
Update
- freeipa freeipa4.13.3 or later
Vendor advisories
- access.redhat.com/security/cve/CVE-2026-73197
- bugzilla.redhat.com/show_bug.cgi?id=2474697
- access.redhat.com/errata/RHSA-2026:70564
- access.redhat.com/errata/RHSA-2026:72279
- access.redhat.com/errata/RHSA-2026:82935
- access.redhat.com/errata/RHSA-2026:83083
- access.redhat.com/errata/RHSA-2026:83084
- access.redhat.com/errata/RHSA-2026:83085
- access.redhat.com/errata/RHSA-2026:83460
- access.redhat.com/errata/RHSA-2026:83461
- access.redhat.com/errata/RHSA-2026:89836
- access.redhat.com/errata/RHSA-2026:93071
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| freeipa freeipa | v < 4.13.3 | 4.13.3 |
| redhat enterprise_linux | 6.0, 7.0, 8.0, 9.0, 10.0 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.