PatchSiren cyber security CVE debrief
CVE-2026-73196 Red Hat CVE debrief
A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value, leading to a denial of service due to excessive CPU and memory resource consumption. The vulnerability affects FreeIPA installations, particularly those with low-privilege user accounts. Evidence from available sources supports this assessment, indicating that improper size limits on OTP key values lead to excessive resource consumption. Further analysis suggests that implementing input validation to limit OTP key values and monitoring system resources for unusual consumption patterns could mitigate the vulnerability. This type of vulnerability typically requires prompt attention to prevent potential denial-of-service attacks. System administrators should review and apply patches or other mitigations as they become available.
- Vendor
- Red Hat
- Product
- Red Hat Enterprise Linux 10
- CVSS
- MEDIUM 4.3
- CISA KEV
- Not listed in stored evidence
- Original CVE published
- 2026-08-20
- Original CVE updated
- 2026-08-24
- Advisory published
- 2026-08-20
- Advisory updated
- 2026-08-24
Who should care
System administrators and security teams responsible for FreeIPA installations, particularly those with low-privilege user accounts, should be aware of this vulnerability and take steps to mitigate it. This includes implementing input validation to limit OTP key values and monitoring system resources for unusual consumption patterns.
Technical summary
The vulnerability is caused by improper size limits on oversized OTP key values submitted by low-privilege authenticated users, leading to excessive CPU and memory resource consumption and a denial of service. This can be mitigated by implementing input validation to limit OTP key values and monitoring system resources for unusual consumption patterns. The vulnerability affects FreeIPA installations, particularly those with low-privilege user accounts.
Defensive priority
Medium priority due to potential for denial of service
Recommended defensive actions
- Implement input validation to limit OTP key values
- Monitor system resources for unusual consumption patterns
- Apply vendor patches as they become available
- Review compensating controls for exposed systems while remediation is scheduled and verified
- Check relevant monitoring, detection, and logs for exposed assets that need extra review
- Track exceptions, retest remediated assets, and close the item only after evidence is documented
- Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
Evidence notes
The vulnerability is caused by improper size limits on oversized OTP key values submitted by low-privilege authenticated users, leading to excessive CPU and memory resource consumption and a denial of service. Evidence from the NVD and Red Hat sources supports this assessment. Further analysis indicates that the vulnerability could be mitigated by implementing input validation to limit OTP key values and monitoring system resources for unusual consumption patterns.
Sources and references
Verified primary and authoritative sources
-
CVE-2026-73196 CVE Program record
Publisher, destination, and source semantics verified
URL: https://www.cve.org/CVERecord?id=CVE-2026-73196
CVE Program - Official CVE Program record with source-provided CVE metadata.
-
CVE-2026-73196 NVD vulnerability detail
Publisher, destination, and source semantics verified
URL: https://nvd.nist.gov/vuln/detail/CVE-2026-73196
NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.
Supplemental references
-
Source reference
Unverified legacy reference
URL: https://access.redhat.com/security/cve/CVE-2026-73196
[email protected] - Vendor Advisory
Methodology and review provenance
AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.