CVE-2026-73196: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 10

This vulnerability involves improper resource allocation handling in FreeIPA's OTP token processing. A low-privilege authenticated user can exploit this by submitting an oversized OTP key value to the `/ipa/session/json` endpoint. The key is decoded and re-encoded without enforcing size limits, leading to excessive CPU and memory usage. This resource exhaustion can cause a denial of service, impacting the availability of the IPA service. The issue is tracked as CVE-2026-73196 and has a CVSS v3.1 base score of 4.3 (medium severity) as scored by Red Hat. The vendor advisory recommends enforcing conservative HTTP request-body size limits on the affected endpoint and restricting token creation to trusted users where feasible.

The vulnerability allows a low-privilege authenticated user to cause a denial of service by consuming excessive CPU and memory resources through oversized OTP key submissions. This degrades the availability of the IPA service but does not impact confidentiality or integrity.

Red Hat advises enforcing conservative HTTP request-body size limits on the `/ipa/session/json` endpoint to reject oversized payloads before they reach the vulnerable parameter conversion. Additionally, if operationally feasible, restrict self-managed token creation to trusted users and implement monitoring or rate-limiting for repeated large authenticated requests. Changes to HTTP server configurations or FreeIPA permissions may require service restarts or reloads. No official patch or fix version is explicitly stated in the advisory; therefore, patch status is not yet confirmed—check the vendor advisory for current remediation guidance.