Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2026-73198: FreeIPA on RHEL may crash from large request
CVE-2026-73198 · published 2 months ago
Summary
The FreeIPA service on Red Hat Enterprise Linux versions 6 through 10 can be forced to use too much memory if an attacker sends an excessively large request to the /ipa/i18n_messages URL. This can slow the system down or stop it from working altogether. Apply the latest Red Hat security updates to the affected RHEL releases to stop the problem.
What to do
- Update freeipa freeipa to version 4.13.3 or later.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | red hat | red hat enterprise linux 10 | All versions |
| – | red hat | red hat enterprise linux 6 | All versions |
| – | red hat | red hat enterprise linux 7 | All versions |
| – | red hat | red hat enterprise linux 8 | All versions |
| – | red hat | red hat enterprise linux 9 | All versions |
| – | redhat | enterprise_linux |
6.0 7.0 8.0 9.0 10.0 cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* |
| – | freeipa | freeipa |
< 4.13.3 cpe:2.3:a:freeipa:freeipa:*:*:*:*:*:*:*:* |
| Debian:12 | debian | freeipa | All versions |
| Debian:13 | debian | freeipa | All versions |
| Ubuntu:Pro:14.04:LTS | canonical | freeipa | All versions |
| Ubuntu:Pro:16.04:LTS | canonical | freeipa | All versions |
| Ubuntu:18.04:LTS | canonical | freeipa | All versions |
| Ubuntu:20.04:LTS | canonical | freeipa | All versions |
| Ubuntu:22.04:LTS | canonical | freeipa | All versions |
| Ubuntu:24.04:LTS | canonical | freeipa | All versions |
| Ubuntu:26.04:LTS | canonical | freeipa | All versions |
| – | red hat | red hat enterprise linux 10.0 extended update support | All versions |
| – | red hat | red hat enterprise linux 9.2 update services for sap solutions | All versions |
| – | red hat | red hat enterprise linux 9.6 extended update support | All versions |
| – | red hat | red hat enterprise linux 8.8 telecommunications update service | All versions |
| – | red hat | red hat enterprise linux 8.8 update services for sap solutions | All versions |
| – | red hat | red hat enterprise linux 9.4 update services for sap solutions | All versions |
| – | red hat | red hat enterprise linux 8.6 advanced mission critical update support | All versions |
| – | red hat | red hat enterprise linux 8.6 extended update support long-life add-on | All versions |
Original advisory text
Ipa: freeipa: unauthenticated dos in `/ipa/i18n_messages` via unbounded request body read
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.
References
- https://ubuntu.com/security/CVE-2026-73198 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-73198 Third Party Advisory
- https://security-tracker.debian.org/tracker/CVE-2026-73198 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:89836
- https://access.redhat.com/downloads/content/package-browser/ URL
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/73xxx/CVE-2026-73198... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-73198 Vendor Advisory
- https://access.redhat.com/errata/RHSA-2026:70564
- https://access.redhat.com/errata/RHSA-2026:72279
- https://access.redhat.com/errata/RHSA-2026:82935
- https://access.redhat.com/errata/RHSA-2026:83083
- https://access.redhat.com/errata/RHSA-2026:83084
- https://access.redhat.com/errata/RHSA-2026:83085
- https://access.redhat.com/errata/RHSA-2026:83460
- https://access.redhat.com/errata/RHSA-2026:83461
- https://access.redhat.com/errata/RHSA-2026:93452
- https://access.redhat.com/security/cve/CVE-2026-73198 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2472960 Issue Tracking Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-770Allocation of Resources Without Limits
Timeline
Published20 Aug 2026
Updated5 Nov 2026
First seen20 Aug 2026
Sources
CVE-2026-73198 · NVD
CVE-2026-73198 · MITRE
UBUNTU-CVE-2026-73198 · OSV
DEBIAN-CVE-2026-73198 · OSV
CVE-2026-73198 · OSV
Track software like this
Free during beta