CVE-2026-73198 Red Hat CVE debrief

Who should care

System administrators and defenders responsible for FreeIPA instances, especially those accessible over the network, should assess exposure and prioritize patching or mitigation. This includes verifying exposure of FreeIPA instances, applying vendor-provided patches or mitigations, and monitoring for unusual traffic patterns to the `/ipa/i18n_messages` endpoint. Additionally, defenders should review compensating controls for exposed systems while remedi

Why it matters

Defenders should prioritize verifying exposure of FreeIPA instances and apply vendor-provided patches or mitigations to prevent potential denial of service (DoS) conditions.

• Potential denial of service (DoS) condition leading to degraded responsiveness
• Memory exhaustion due to large request bodies
• Need for verification of FreeIPA instance exposure and vendor-provided patches or mitigations

Technical summary

The vulnerability exists in the `/ipa/i18n_messages` endpoint of FreeIPA, allowing a remote, unauthenticated attacker to cause a denial of service (DoS) condition by sending an arbitrarily large request body, leading to memory exhaustion and degraded responsiveness. The vulnerability is caused by the lack of input validation on the request body size. This can lead to memory exhaustion, causing the service to become unresponsive. The affected product is FreeIPA, and the vulnerability is confirmed to exist in the `/ipa/i18n_messages` endpoint.

Defensive priority

Defenders should prioritize verifying exposure of FreeIPA instances, especially those accessible over the network, and apply vendor-provided patches or mitigations.

Recommended defensive actions

• Verify exposure of FreeIPA instances, especially those accessible over the network
• Apply vendor-provided patches or mitigations
• Monitor for unusual traffic patterns to the `/ipa/i18n_messages` endpoint
• Consider implementing rate limiting or IP blocking to prevent exploitation
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, CVSS score, and affected products. The vulnerability is confirmed to exist in FreeIPA, and the `/ipa/i18n_messages` endpoint is the affected component. However, the exact scope of affected deployments and potential mitigations are not detailed in the CVE record or NVD entry. Defenders should verify exposure of FreeIPA instances, especially those accessible over the network, and apply vendor-provided patches or mitigations.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.