CVE-2026-73198: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 9

A flaw in FreeIPA allows remote unauthenticated attackers to exploit the /ipa/i18n_messages endpoint by sending arbitrarily large request bodies. This triggers excessive memory allocation without limits or throttling, resulting in memory exhaustion and a denial of service condition. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and has a CVSS v3.1 base score of 7.5 (high severity).

The vulnerability can cause the FreeIPA service to consume excessive memory resources, leading to degraded responsiveness and denial of service. There is no impact on confidentiality or integrity, but availability is severely affected. No known exploits are reported in the wild.

Red Hat advises configuring Apache to enforce a request body size limit on the /ipa/i18n_messages endpoint using the LimitRequestBody directive (e.g., LimitRequestBody 1048576 to limit to 1MB). This requires restarting the Apache HTTP Server (httpd), which may temporarily impact FreeIPA availability. If a reverse proxy or load balancer is used, it should also enforce equivalent request body size limits. This mitigation effectively prevents exploitation by limiting resource consumption.