CVE-2026-73197: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 9

CVE-2026-73197 is a resource allocation flaw in FreeIPA on Red Hat Enterprise Linux 9. An unauthenticated attacker can exploit this by sending oversized form POST requests to the /ipa/migration/migration.py endpoint, causing the migration handler to read the entire attacker-controlled request body into memory. This results in increased memory usage, slower request handling, and potential denial of service due to resource exhaustion. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling).

The vulnerability can cause a denial of service by exhausting server memory resources, leading to degraded performance or service outages. There is no impact on confidentiality or integrity, but availability is highly impacted.

Red Hat provides configuration-based mitigations. If the /ipa/migration endpoint is not needed, it should be disabled by removing or commenting out the Alias and Directory blocks in the Apache configuration (e.g., /etc/httpd/conf.d/ipa.conf). Alternatively, administrators can limit the size of request bodies processed by this endpoint by adding a LimitRequestBody directive (e.g., 1 MiB) in the Apache configuration within the <Directory "/usr/share/ipa/migration"> block. After changes, the httpd service must be reloaded or restarted. No official patch is explicitly stated in the advisory, so patch status is not yet confirmed — check the vendor advisory for updates.