CVE-2026-73198
published 2026-08-20CVE-2026-73198: A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.54%
44.6th percentile
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| freeipa | freeipa | < 4.13.3 | 4.13.3 |
| red_hat | ipa | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
| redhat | enterprise_linux | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read
vendor_redhat·2026-08-20·CVSS 7.5
CVE-2026-73198 [HIGH] CWE-770 ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read
ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.
Mitigation: To mitigate this issue, configure Apache to enforce a request-body limit for the `/ipa/i18n_messages` endpoint. This can be achieved by adding `LimitRequestBody` directive within the Apache configuration for IPA. For example, to limit the request body to 1MB, add `LimitRequestBody 1048576` to the relevant `` block or a broader `/ipa/*` location. A restart of the Apac
GHSA
A flaw was found in FreeIPA.
ghsa_unreviewed·2026-08-20
CVE-2026-73198 [HIGH] CWE-770 A flaw was found in FreeIPA.
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-73198 freeipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read [fedora-all]
bugzilla·2026-08-20·CVSS 7.5
CVE-2026-73198 [HIGH] CVE-2026-73198 freeipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read [fedora-all]
CVE-2026-73198 freeipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
AI_ONLY_REPORT
package: ipa-4.13.1-3.el10
Summary: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request
Body Read: the public i18n endpoint reads attacker-controlled request
bodies into memory without a size limit before rejecting invalid commands,
allowing remote unauthenticated memory exhaustion and service degradation.
Requirements to exploit: Network reachability to `/ipa/i18n_messages` and
the ability to send large POST bodies. Au
Bugzilla
CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read
bugzilla·2026-05-11·CVSS 7.5
CVE-2026-73198 [HIGH] CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read
CVE-2026-73198 ipa: FreeIPA: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request Body Read
AI_ONLY_REPORT
package: ipa-4.13.1-3.el10
Summary: Unauthenticated DoS in `/ipa/i18n_messages` via Unbounded Request
Body Read: the public i18n endpoint reads attacker-controlled request
bodies into memory without a size limit before rejecting invalid commands,
allowing remote unauthenticated memory exhaustion and service degradation.
Requirements to exploit: Network reachability to `/ipa/i18n_messages` and
the ability to send large POST bodies. Authentication is not required.
Exploitability and impact are reduced if Apache, mod_wsgi, or an upstream
proxy already enforces a strict request-body limit.
Component affected: `ipa-4.13.1-3.el10` in `ipaserver/rpcserver.py`
(`read_input()`, `
https://access.redhat.com/errata/RHSA-2026:70564https://access.redhat.com/errata/RHSA-2026:72279https://access.redhat.com/errata/RHSA-2026:82935https://access.redhat.com/errata/RHSA-2026:83083https://access.redhat.com/errata/RHSA-2026:83084https://access.redhat.com/errata/RHSA-2026:83085https://access.redhat.com/errata/RHSA-2026:83460https://access.redhat.com/errata/RHSA-2026:83461https://access.redhat.com/security/cve/CVE-2026-73198https://bugzilla.redhat.com/show_bug.cgi?id=2472960
2026-08-20
Published