(A flaw was found in FreeIPA. A low-privilege authenticated user can ex ...) (CVE-2026-73196)

CVE-2026-73196 is a resource exhaustion vulnerability in FreeIPA where a low-privilege authenticated user can submit an oversized OTP key value. The vulnerable code decodes and re-encodes this OTP key without enforcing size limits, causing excessive CPU and memory usage. This can lead to denial of service by degrading the availability of the IPA service. The weakness is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). No known exploits in the wild have been reported. The vulnerability affects FreeIPA but no specific affected versions are stated in the input data. Red Hat's advisory recommends mitigation by enforcing conservative HTTP request-body size limits on the /ipa/session/json endpoint and restricting token creation to trusted users where feasible.

The vulnerability allows a low-privilege authenticated user to cause denial of service by consuming excessive CPU and memory resources through oversized OTP key submissions. This degrades the availability of the FreeIPA service but does not impact confidentiality or integrity. There are no known active exploits in the wild.

Red Hat advises enforcing conservative HTTP request-body size limits on the /ipa/session/json endpoint to reject oversized payloads before they reach the vulnerable OTP parameter processing. Additionally, restricting self-managed token creation to trusted users and implementing monitoring or rate-limiting for repeated large authenticated requests can mitigate the issue. Changes to HTTP server configurations or FreeIPA permissions may require service restarts or reloads. No official patch or fix version is stated; patch status is not yet confirmed—check the vendor advisory for updates.