ZeroDay Findings
Sign inSign up

Findings

CVE-2026-73197

A flaw was found in FreeIPA.

Published Aug 20, 2026 · updated Oct 15, 2026 · Red Hat Red Hat Enterprise Linux 10

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Aug 20, 2026 · NIST NVD

    Detected

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

  2. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

  3. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

  4. Oct 14, 2026 · NIST NVD

    Updated

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

  5. Oct 15, 2026 · NIST NVD

    Updated

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

Affected

  • cpe freeipa/freeipaversion unspecified
  • cpe redhat/enterprise linux10.0
  • cpe redhat/enterprise linux6.0
  • cpe redhat/enterprise linux7.0
  • cpe redhat/enterprise linux8.0
  • cpe redhat/enterprise linux9.0
  • vendor Red Hat Red Hat Enterprise Linux 10version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 10.0 Extended Update Supportversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 6version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 7version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.8 Telecommunications Update Serviceversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 8.8 Update Services for SAP Solutionsversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9version unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9.2 Update Services for SAP Solutionsversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9.4 Update Services for SAP Solutionsversion unspecified
  • vendor Red Hat Red Hat Enterprise Linux 9.6 Extended Update Supportversion unspecified

Sources

  • CIRCL Vulnerability LookupVulnerability recordCVE-2026-73197

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory u

    vulnerability.circl.lu
  • CVE.orgVulnerability recordCVE-2026-73197

    Official CVE identifier

    cve.org
  • FIRST EPSSExploitation probabilityCVE-2026-73197

    30-day exploitation probability 0.5%

    first.org
  • NIST NVDVulnerability recordCVE-2026-73197

    A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory,

    nvd.nist.gov

References