CVE-2026-73197: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 10

This vulnerability involves allocation of resources without limits or throttling in the FreeIPA component of Red Hat Enterprise Linux 10. Specifically, the migration handler at the /ipa/migration/migration.py endpoint does not limit the size of incoming POST request bodies. An unauthenticated remote attacker can exploit this by sending oversized form POST requests, forcing the handler to read the entire attacker-controlled request body into memory. This can cause excessive memory usage, degrade request handling performance, and potentially disrupt or deny service. Red Hat has published an official security advisory (RHSA-2026:70564) that includes patches to fix this issue.

The vulnerability allows a remote unauthenticated attacker to cause a denial of service by exhausting memory resources on the affected system. There is no impact on confidentiality or integrity, but availability can be severely affected due to increased memory usage and slower request processing. This can lead to service disruption or downtime of the FreeIPA service on Red Hat Enterprise Linux 10.

An official fix is available from Red Hat as part of the ipa package updates included in the security advisory RHSA-2026:70564. Users should apply the update to remediate this vulnerability. No additional mitigation steps are required beyond applying the vendor-provided patch.