PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-73196 Red Hat CVE debrief

A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value, leading to a denial of service due to excessive CPU and memory resource consumption. The vulnerability affects FreeIPA installations, particularly those with low-privilege user accounts. Evidence from available sources supports this assessment, indicating that improper size limits on OTP key values lead to excessive resource consumption. Further analysis suggests that implementing input validation to limit OTP key values and monitoring system resources for unusual consumption patterns could mitigate the vulnerability. This type of vulnerability typically requires prompt attention to prevent potential denial-of-service attacks. System administrators should review and apply patches or other mitigations as they become available.

Vendor
Red Hat
Product
Red Hat Enterprise Linux 10
CVSS
MEDIUM 4.3
CISA KEV
Not listed in stored evidence
Original CVE published
2026-08-20
Original CVE updated
2026-08-24
Advisory published
2026-08-20
Advisory updated
2026-08-24

Who should care

System administrators and security teams responsible for FreeIPA installations, particularly those with low-privilege user accounts, should be aware of this vulnerability and take steps to mitigate it. This includes implementing input validation to limit OTP key values and monitoring system resources for unusual consumption patterns.

Technical summary

The vulnerability is caused by improper size limits on oversized OTP key values submitted by low-privilege authenticated users, leading to excessive CPU and memory resource consumption and a denial of service. This can be mitigated by implementing input validation to limit OTP key values and monitoring system resources for unusual consumption patterns. The vulnerability affects FreeIPA installations, particularly those with low-privilege user accounts.

Defensive priority

Medium priority due to potential for denial of service

Recommended defensive actions

  • Implement input validation to limit OTP key values
  • Monitor system resources for unusual consumption patterns
  • Apply vendor patches as they become available
  • Review compensating controls for exposed systems while remediation is scheduled and verified
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability is caused by improper size limits on oversized OTP key values submitted by low-privilege authenticated users, leading to excessive CPU and memory resource consumption and a denial of service. Evidence from the NVD and Red Hat sources supports this assessment. Further analysis indicates that the vulnerability could be mitigated by implementing input validation to limit OTP key values and monitoring system resources for unusual consumption patterns.

Sources and references

Verified primary and authoritative sources

  • CVE-2026-73196 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-73196

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-73196 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73196

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.