CVE-2026-73196: 
NixOS 脆弱性の分析と軽減

CVE-2026-73196 is an authenticated denial-of-service vulnerability in FreeIPA caused by unbounded OTP key decoding and re-encoding in the otptoken-add command. A low-privilege authenticated user can submit an oversized ipatokenotpkey (OTP key) value via the IPA RPC interface, triggering excessive CPU and memory consumption in the IPA API worker. All FreeIPA versions before 4.13.3 are affected, as well as Red Hat Enterprise Linux 6, 7, 8, 9, and 10 shipping the ipa package. The vulnerability was reported on May 11, 2026, and publicly disclosed on August 20, 2026. CVSS v3.1 scores vary by source: NVD rates it 6.5 (Medium), while Red Hat and cve.org rate it 4.3 (Medium) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in ipaserver/plugins/otptoken.py. Specifically, the OTPTokenKey._convert_scalar() method decodes attacker-supplied Base32 input without enforcing any size limit, and otptoken_add.pre_callback() subsequently Base32-re-encodes the decoded bytes and URL-encodes them into an otpauth:// URI — all within a single synchronous API worker request. An attacker submits a JSON-RPC otptoken_add request to /ipa/session/json with a very large valid Base32 string (e.g., ~32 MiB of repeated A characters) as the ipatokenotpkey parameter; the server performs the full decode-encode-URL-encode cycle before returning, consuming substantial CPU and memory. The precondition is authenticated access to the IPA RPC interface with self-managed token creation rights, which is granted to ordinary users by default via the Users can create self-managed tokens ACI. A proposed patch adds MAX_OTPKEY_BYTES = 1024 and MAX_OTPKEY_B32_CHARS limits checked before and after decoding (Red Hat Bugzilla, Red Hat CVE).

Successful exploitation degrades or denies availability of the FreeIPA/IPA service by exhausting CPU and memory resources in the API worker process. There is no confidentiality or integrity impact — attackers cannot read data or modify directory entries through this vulnerability. Repeated or parallelized requests can amplify the effect, potentially causing sustained service outages for all users depending on the IPA service for authentication and identity management (Red Hat Bugzilla, Red Hat CVE).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, and NVD SSVC assessment indicates exploitation is "none" and not automatable. The EPSS score is approximately 0.22%, placing it in the 15th percentile for exploitation likelihood. Exploitation requires a valid low-privilege account on the IPA domain, limiting the attack surface compared to unauthenticated vulnerabilities (Red Hat CVE, GitHub Advisory).

1. Authenticate: Obtain valid credentials for any low-privilege user account in the FreeIPA domain that has self-managed token creation rights (granted by default via the Users can create self-managed tokens ACI).
2. Establish a session: Authenticate to the IPA JSON-RPC endpoint at /ipa/session/login_password to obtain a valid session cookie.
3. Craft the malicious request: Construct a JSON-RPC otptoken_add request with type set to totp and ipatokenotpkey set to a very large valid Base32 string (e.g., approximately 32 MiB of repeated A characters).
4. Submit the request: POST the crafted payload to /ipa/session/json with Content-Type: application/json and the authenticated session cookie.
5. Observe resource exhaustion: The IPA API worker performs Base32 decode, Base32 re-encode, URL encoding, and otpauth:// URI construction on the oversized input, consuming excessive CPU and memory.
6. Amplify the attack: Repeat or parallelize multiple such requests to further degrade or deny IPA service availability for all users (Red Hat Bugzilla).

• Network: Unusually large HTTP POST requests (multi-megabyte bodies) to /ipa/session/json from authenticated users; repeated requests to the same endpoint in rapid succession from a single source IP.
• Logs: IPA API access logs showing otptoken_add calls with abnormally large request bodies; slow or timed-out responses logged for /ipa/session/json; worker process errors or OOM-related messages in IPA server logs.
• Process: Sustained high CPU or memory usage by the IPA API worker process (ipaserver or httpd worker handling IPA RPC); potential worker crashes or restarts due to memory exhaustion.
• System: System-level OOM killer events (oom_kill_process) referencing the Apache/IPA worker in /var/log/messages or dmesg output (Red Hat Bugzilla, Red Hat CVE).

Upgrade FreeIPA to version 4.13.3 or later, which includes the fix enforcing size limits on ipatokenotpkey before decoding. As an interim workaround, enforce conservative HTTP request-body size limits on the /ipa/session/json endpoint (e.g., via Apache LimitRequestBody) to reject oversized payloads before they reach the vulnerable code path. Additionally, if operationally feasible, restrict self-managed token creation to trusted users by modifying the default ACI, and implement rate-limiting or monitoring for repeated large authenticated requests. Service restarts or reloads may be required after configuration changes (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and reported through Red Hat's coordinated disclosure process. Red Hat classified the flaw as Medium severity with a CVSS score of 4.3, noting that some deployments may reduce exposure through front-end request-size controls. No significant broader media coverage or notable community commentary has been identified beyond standard vulnerability database entries (Red Hat CVE, Red Hat Bugzilla).