CVE-2026-73196
published 2026-08-20CVE-2026-73196: A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.43%
35.9th percentile
A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freeipa | freeipa | < 4.13.3 | 4.13.3 |
| red_hat | ipa | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
A flaw was found in FreeIPA.
ghsa_unreviewed·2026-08-20
CVE-2026-73196 [MEDIUM] CWE-770 A flaw was found in FreeIPA.
A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service.
Red Hat
ipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding
vendor_redhat·2026-08-20·CVSS 4.3
CVE-2026-73196 [MEDIUM] CWE-770 ipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding
ipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding
A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service.
Mitigation: To mitigate this issue, enforce conservative HTTP request-body limits on the `/ipa/session/json` endpoint to reject oversized payloads before they reach the vulnerable IPA parameter conversion. Additionally, if operationally feasible, restrict self-managed token creation to trusted users and implement monitoring or rate-limit
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73196 freeipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding [fedora-all]
bugzilla·2026-08-20·CVSS 4.3
CVE-2026-73196 [MEDIUM] CVE-2026-73196 freeipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding [fedora-all]
CVE-2026-73196 freeipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: ipa-4.13.1-3.el10
Summary: Authenticated DoS in `otptoken-add` via unbounded OTP key
decoding/re-encoding: a low-privilege authenticated user can submit an
oversized `ipatokenotpkey` value that is Base32-decoded, re-encoded, and
embedded into an enrollment URI without an effective size bound, causing
excessive CPU and memory use in the IPA API worker handling the request.
Requirements to exploit: Authenticated access to t
Bugzilla
CVE-2026-73196 ipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding
bugzilla·2026-05-11·CVSS 4.3
CVE-2026-73196 [MEDIUM] CVE-2026-73196 ipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding
CVE-2026-73196 ipa: FreeIPA: Authenticated DoS in `otptoken-add` via unbounded OTP key decoding/re-encoding
AI_ONLY_REPORT
package: ipa-4.13.1-3.el10
Summary: Authenticated DoS in `otptoken-add` via unbounded OTP key
decoding/re-encoding: a low-privilege authenticated user can submit an
oversized `ipatokenotpkey` value that is Base32-decoded, re-encoded, and
embedded into an enrollment URI without an effective size bound, causing
excessive CPU and memory use in the IPA API worker handling the request.
Requirements to exploit: Authenticated access to the IPA RPC interface as a
user allowed to create self-managed OTP tokens, plus the ability to submit
an oversized request body that is not rejected earlier by
deployment-specific HTTP request-size controls.
Component affected: `ipa-4.13.1-3.e
2026-08-20
Published