Ipa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
Historical advisory recorded 30 Oct 2026 18:45:26 UTC. Read the latest advisory.
cve-program · CVE-2026-73197
PublishedA flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
Read the publisher's advisoryAffected versions, risk and source history
cve-program · CVE-2026-73197
PublishedIpa: freeipa: unauthenticated dos in `/ipa/migration/migration.py` via unbounded request body read
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
- Source published
- 20 Aug 2026 10:31:31 UTC
- Source modified
- 30 Oct 2026 17:36:06 UTC
- Saved here
- 30 Oct 2026 18:45:26 UTC
- Source terms
- CVE Program Terms of Use
Original source record · Cite this exact observation · Complete original publisher JSON
Source: cve-program · CVE Program Terms of Use. The publisher's wording is preserved. ChangeIntel groups the information and labels changes. The JSON record includes additional source fields.
CVSS 3.1 · 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H