CVE-2026-73198: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Enterprise Linux 10

CVE-2026-73198 is a denial of service vulnerability in FreeIPA on Red Hat Enterprise Linux 10, where unauthenticated remote attackers can exploit the /ipa/i18n_messages endpoint by sending an arbitrarily large request body. This causes unbounded resource consumption, specifically excessive memory usage, leading to memory exhaustion and degraded service availability. Red Hat has released security updates for Red Hat Enterprise Linux 9 addressing this issue as part of a broader set of FreeIPA fixes. The vulnerability has a CVSS 3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).

The vulnerability allows remote unauthenticated attackers to cause a denial of service by exhausting memory resources on the affected system, resulting in degraded responsiveness or service outages. There is no impact on confidentiality or integrity reported. No active exploitation in the wild is known.

Red Hat has released security updates that fix this vulnerability. Users should apply the relevant FreeIPA updates provided in Red Hat Enterprise Linux 9. For Red Hat Enterprise Linux 10, check the vendor advisory for patch availability and apply updates accordingly. Since this is not a cloud service, remediation requires applying vendor patches. Patch status for RHEL 10 is not explicitly confirmed in the advisory; verify current updates on Red Hat's official security pages.