Threats Tagged 'cve-2026-73198'

Red Hat Identity Management (IdM) is a centralized authentication, identity management, and authorization solution for both traditional and cloud-based enterprise environments. Security Fix(es): * ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read (CVE-2026-73198) * ipa: FreeIPA: Unauthenticated DoS in `/ipa/migration/migration.py` via Unbounded Request Body Read (CVE-2026-73197) * FreeIPA: idm: ipa: FreeIPA: Obtaining TGS with impersonating cname through trust relationships (CVE-2026-11861) * freeipa: ipa: FreeIPA/IdM: Cross-Site Scripting vulnerability allows arbitrary code execution via crafted URL (CVE-2026-18147) * freeipa: ipa: FreeIPA: trust-fetch-domains uses trust-read ACI to gate a privileged AD trust refresh, allowing unauthorized LDAP writes (CVE-2026-19550) * ipa: Privilege escalation via krbCanonicalName manipulation due to realm-unaware uniqueness enforcement in FreeIPA LDAP datastore (CVE-2026-13097) * ipa: freeipa: FreeIPA: unauthenticated LDAP client can obtain administrator credentials via the self-managed-token ACI (CVE-2026-76578) * freeIPA: idm: freeipa: idp-add eval() reachable before authorization check allows environment disclosure and denial of service (CVE-2026-79678) Bug Fix(es) and Enhancement(s): * [Cursor Automated] Include latest fixes in python3-ipatests package [RHEL10.2] (JIRA:RHEL-173375) * WebUI Hardening [rhel-10.2.z] (JIRA:RHEL-238510) * ipa-otptoken-import hardening [rhel-10.2.z] (JIRA:RHEL-238518) * host-mod: handle the password attribute when set with --setattr userpassword= [rhel-10.2.z] (JIRA:RHEL-238522) * ipa env: support only simple * wildcard [rhel-10.2.z] (JIRA:RHEL-238526) * ipa-epn: drop_privileges method is mixing uid and gid [rhel-10.2.z] (JIRA:RHEL-238673) * ipa-migrate: require Replication Administrator privilege [rhel-10.2.z] (JIRA:RHEL-238676) * ipa-migrate tool is renaming host records & host info in automount information [rhel-10.2.z] (JIRA:RHEL-240768) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2026-73198 is a vulnerability in FreeIPA on Red Hat Enterprise Linux 9 where an unauthenticated remote attacker can send an arbitrarily large request body to the /ipa/i18n_messages endpoint. This causes excessive memory consumption, leading to degraded service responsiveness and denial of service (DoS).

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.