CVE-2026-73198
A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.
- Affected products
- Freeipa
- Redhat Enterprise Linux
- = 6.0, 7.0, 8.0, 9.0, 10.0
- CVSS 3.1
- 7.5 HIGH
- EPSS
- 0.3% (26th percentile)
- Weakness
- CWE-770
- NVD status
- Analyzed
- Published
- 2026-08-20
Workaround
To mitigate this issue, configure Apache to enforce a request-body limit for the `/ipa/i18n_messages` endpoint. This can be achieved by adding `LimitRequestBody` directive within the Apache configuration for IPA. For example, to limit the request body to 1MB, add `LimitRequestBody 1048576` to the relevant `` block or a broader `/ipa/*` location. A restart of the Apache HTTP Server (`httpd`) service is required for the changes to take effect, which may temporarily impact FreeIPA service availability. If a reverse proxy or load balancer is used, ensure it also enforces an equivalent body-size limit.
No indexed exploits for CVE-2026-73198 yet
Our index is partial: it proves presence, never absence
No exploit for CVE-2026-73198 has been indexed yet. Our index is built from live traffic and upstream syncs, so this page can only say what it knows — not that no exploit exists.