CVE-2026-73197
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.
- Affected products
- Freeipa
- Redhat Enterprise Linux
- = 6.0, 7.0, 8.0, 9.0, 10.0
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 0.3% (26th percentile)
- Weakness
- CWE-770
- NVD status
- Analyzed
- Published
- 2026-08-20
Workaround
If the `/ipa/migration` endpoint is not required, it can be disabled by commenting out or removing the `Alias /ipa/migration` and its corresponding `` block in the Apache configuration file (e.g., `/etc/httpd/conf.d/ipa.conf`). Alternatively, to limit the size of request bodies processed by the `/ipa/migration` endpoint, add the `LimitRequestBody` directive within the `` block in your Apache configuration, setting a conservative limit such as 1 MiB (1048576 bytes): ```apache LimitRequestBody 1048576 # ... other directives ... ``` After modifying the Apache configuration, the `httpd` service must be reloaded or restarted for the changes to take effect. This may temporarily interrupt service.
No indexed exploits for CVE-2026-73197 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-73197 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.