This vulnerability involves the allocation of resources without limits or throttling in FreeIPA's handling of OTP keys. A low-privilege authenticated user can exploit this by submitting an oversized OTP key value, which is decoded and re-encoded without enforcing size restrictions. This leads to excessive CPU and memory usage, potentially causing a denial of service by degrading the IPA service availability. The vulnerability is identified as CWE-770 and has a CVSS v3.1 score of 4.3 (medium severity).

The impact is limited to availability degradation of the IPA service due to resource exhaustion (CPU and memory) caused by processing oversized OTP keys. There is no impact on confidentiality or integrity. The vulnerability requires low privileges and no user interaction, and it can be exploited remotely over the network.

Red Hat recommends enforcing conservative HTTP request-body size limits on the /ipa/session/json endpoint to reject oversized payloads before they reach the vulnerable parameter conversion. Additionally, restricting self-managed token creation to trusted users and implementing monitoring or rate-limiting for repeated large authenticated requests can mitigate the issue. Changes to HTTP server configurations or FreeIPA permissions may require service restarts or reloads. No official fix or patch is currently confirmed; users should apply these mitigations and monitor the vendor advisory for updates.