Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-08-20T10:05:49 ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-770

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

Red Hat would like to thank AISLE Research for reporting this issue. If the `/ipa/migration` endpoint is not required, it can be disabled by commenting out or removing the `Alias /ipa/migration` and its corresponding `<Directory>` block in the Apache configuration file (e.g., `/etc/httpd/conf.d/ipa.conf`). Alternatively, to limit the size of request bodies processed by the `/ipa/migration` endpoint, add the `LimitRequestBody` directive within the `<Directory "/usr/share/ipa/migration">` block in your Apache configuration, setting a conservative limit such as 1 MiB (1048576 bytes): ```apache <Directory "/usr/share/ipa/migration"> LimitRequestBody 1048576 # ... other directives ... </Directory> ``` After modifying the Apache configuration, the `httpd` service must be reloaded or restarted for the changes to take effect. This may temporarily interrupt service. Red Hat Enterprise Linux 10 Affected ipa Red Hat Enterprise Linux 6 Out of support scope ipa Red Hat Enterprise Linux 7 Affected ipa Red Hat Enterprise Linux 8 Affected ipa Red Hat Enterprise Linux 9 Affected ipa https://www.cve.org/CVERecord?id=CVE-2026-73197 https://nvd.nist.gov/vuln/detail/CVE-2026-73197