CVE-2026-73198

Executive Summary

CVE-2026-73198 is a high-severity denial-of-service (DoS) vulnerability affecting FreeIPA, the open-source identity management solution shipped with Red Hat Enterprise Linux. A remote, unauthenticated attacker can exploit the /ipa/i18n_messages endpoint by transmitting an arbitrarily large request body, which forces the service to allocate excessive memory and ultimately cause memory exhaustion.

The vulnerability carries a CVSS score of 7.5, driven by network-explotability with no authentication requirement and high availability impact. Affected organizations running FreeIPA on Red Hat Enterprise Linux should prioritize assessment and patching, as the attack requires no credentials and can be triggered remotely. No public PoC or exploitation in the wild has been reported to date, and the CISA KEV catalog does not list this CVE.

Technical Analysis

Vulnerability Mechanism

The flaw resides in the /ipa/i18n_messages endpoint of the FreeIPA web interface. This endpoint is used to serve internationalization (i18n) message catalogs to the web UI. The vulnerable code path fails to impose a maximum size limit on the incoming request body.

Attack Surface

The endpoint is reachable by unauthenticated users — no session, cookie, or authentication token is required. FreeIPA exposes this HTTP endpoint on the default web server port (typically 443/HTTPS) as part of its standard deployment. An attacker on the network can send direct HTTP requests to this endpoint without any prior reconnaissance beyond identifying the target's IP address and confirming FreeIPA is listening.

Underlying Flaw Class

This vulnerability belongs to CWE-770 (Allocation of Resources Without Limits or Throttling). The application performs a memory allocation operation whose size is directly or indirectly derived from the length of the incoming request body, without enforcing a cap. Each large request causes the service to store the body (or a processed representation of it) in memory. Because there is no rate limiting, connection throttling, or per-request size validation, an attacker can amplify memory consumption by either:

• Sending a single extremely large request body (e.g., hundreds of megabytes)
• Sending many moderately sized requests concurrently to saturate available memory

Technical Impact

When the service exhausts available memory, the FreeIPA web process will degrade in responsiveness, potentially crash, or trigger Linux's OOM (Out-Of-Memory) killer, which may kill the FreeIPA process itself or other processes on the same host. The result is a complete denial of service for all FreeIPA functions — including authentication, user management, Kerberos ticket issuance, and DNS service — not just the affected endpoint.

Missing Details

The NVD description does not specify the exact code-level mechanism (e.g., whether the request body is copied into a fixed buffer, streamed into memory, or base64-decoded before allocation), nor does it disclose the exact affected FreeIPA versions. The patch is claimed by a single source (NVD) but not independently confirmed, and no vendor advisory with version specifics has been published. Insufficient technical detail is available for a precise code-level analysis.

Exploitation Scenarios

No public PoC or exploit code exists for this CVE as of this report. The attack chain below is inferred from the vulnerability class and the NVD description; it is presented at the mechanism level without invented implementation specifics.

Step 1: Reconnaissance and Target Identification

An attacker identifies FreeIPA instances through:

• Internet-wide scanning for the FreeIPA web login page or default ports (443)
• Shodan/Censys queries targeting FreeIPA fingerprints, such as the /ipa/ui/ path or specific HTTP response headers
• Internal network reconnaissance to locate identity management infrastructure

The attacker confirms the target is running FreeIPA by checking for the standard login redirect to /ipa/ui/ or the presence of the CSRF token in the login page.

Step 2: Triggering the Flaw

The attacker crafts a raw HTTP request (or uses tools like curl, Python requests, or a custom script) targeting the endpoint:

POST /ipa/i18n_messages HTTP/1.1
Host: <target-ip>
Content-Type: text/plain
Content-Length: <large-value>

<arbitrarily large body>

The request requires no authentication headers or session cookies. The attacker controls the body size and can ramp it up iteratively.

Step 3: Payload and Execution

At the vulnerability-class level, the "payload" is simply the request body size itself. The attacker has two amplification strategies:

• Single-shot exhaustion: Send one or a few requests with bodies in the hundreds-of-MB range to exhaust available memory on the target
• Distributed low-and-slow: Send many moderate-size requests concurrently from multiple source IPs to evade naive per-source rate limiting and exhaust memory gradually

Because the endpoint is unauthenticated and network-exposed, any host that can reach the FreeIPA server can participate in the attack. An attacker with a botnet or multiple cloud instances can easily generate sufficient concurrent connections.

Step 4: Post-Exploitation Impact

Memory exhaustion leads to:

• Service degradation: FreeIPA web UI and API respond slowly or hang
• Process crash: The web server worker process terminates due to allocation failure
• OOM kill: Linux kernel kills the FreeIPA process or other processes on the host
• Cascading failures: Since FreeIPA is the identity backbone, all dependent services (Kerberos authentication, LDAP lookups, DNS, sudo policies, SSH key management) become unavailable

The impact is a complete denial of service for the identity infrastructure. There is no confidentiality or integrity impact (CVSS C:N/I:N), but the availability impact is high (A:H).

Impact Assessment

CVSS Breakdown (per vector components)

• Attack Vector (AV:N): Network-exploitable — remote attacker, no physical or local access
• Attack Complexity (AC:L): Low — no special conditions or race conditions required
• Privileges Required (PR:N): None — unauthenticated attacker
• User Interaction (UI:N): None — no victim action required
• Scope (S:U): Unchanged — impact limited to the vulnerable component
• Confidentiality (C:N): None
• Integrity (I:N): None
• Availability (A:H): High — complete loss of service availability

Overall: 7.5 (High)

Business Impact

For enterprise environments, FreeIPA provides centralized identity, authentication (Kerberos), and policy management. A successful DoS against FreeIPA cascades to:

• Authentication outages: All users unable to log in to Linux/Unix systems, web applications using SSO, or VPN infrastructure
• Kerberos ticket issuance failures: Breaks single sign-on across the entire domain
• DNS outages: If FreeIPA is managing DNS records, name resolution for the identity domain fails
• Operational disruption: SSH access, sudo policy enforcement, and host-based access control all depend on FreeIPA

Blast Radius

The blast radius extends beyond the FreeIPA server itself to every system, service, and user that depends on it. In environments where FreeIPA acts as the central identity provider, a single attacker can effectively shut down authentication for the entire organization.

EPSS Context

EPSS score of 0.00347 places this CVE in the 27.9th percentile of exploitation probability. This indicates low current exploitation likelihood, but the ease of exploitation (no auth, trivial mechanics) suggests the score may rise if a PoC becomes public or if the vulnerability is widely discussed.

Detection Guidance

Sigma Rule

title: FreeIPA i18n_messages Endpoint Excessive Request Body
id: 8f3a9b2c-4d5e-4f6a-8b7c-9d0e1f2a3b4c
status: experimental
description: Detects HTTP POST requests to /ipa/i18n_messages with excessively large request bodies, indicating potential memory exhaustion DoS attempts against FreeIPA.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-73198
author: Valtersit Threat Intelligence
date: 2026/07/15
logsource:
    category: webserver
    product: apache
    definition: 'Requires web server access logs with request body size logging enabled'
detection:
    selection_endpoint:
        cs-method: 'POST'
        cs-uri-stem: '/ipa/i18n_messages'
    selection_size:
        cs-bytes|gte: 10485760  # 10 MB threshold
    condition: selection_endpoint and selection_size
falsepositives:
    - Legitimate bulk i18n message updates (rare, normally small)
    - Internal monitoring tools sending large payloads
level: high
tags:
    - attack.t1499
    - cve.2026-73198
    - cwe.770

YARA Rule

rule FreeIPA_i18n_DoS_Request_Body
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects HTTP request bodies targeting /ipa/i18n_messages with excessive size"
        cve = "CVE-2026-73198"
        date = "2026-07-15"
        score = "75"

    strings:
        $endpoint = "/ipa/i18n_messages"
        $method = "POST"
        $http_ver = "HTTP/1."

    condition:
        // Match HTTP request method and endpoint, then flag on Content-Length
        uint16(0) == 0x504F and                 // "PO" for POST
        $endpoint in (0..filesize) and
        $http_ver in (0..filesize) and
        (
            // Content-Length header indicating large body (>= 10MB)
            for any i in (1..5) : (
                @endpoint[i] > 0 and
                // Find "Content-Length:" after the endpoint position
                locate_content_length(@endpoint[i], filesize)
            )
        )

    condition:
        filesize > 50KB and
        $endpoint and
        // Likely large payload
        filesize > 10000000  // 10 MB threshold
}

Note: The YARA rule above uses a simplified heuristic. A production rule should parse the Content-Length header value specifically rather than relying on file size, but file size serves as a useful proxy for detection.

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-73198 FreeIPA i18n_messages DoS Attempt"; flow:to_server; http.method; content:"POST"; http.uri; content:"/ipa/i18n_messages"; http.request_body; length:10000000:>; classtype:attempted-dos; sid:202673198; rev:1; metadata:cve CVE-2026-73198, attack_target server, created_at 2026_07_15, updated_at 2026_07_15;)

Elastic Detection

any where process.name == "httpd" and event.action in ("open", "read") and
  /* Detect abnormal I/O for httpd worker processes */
  (
    /* File-based: large request body written to temp files */
    file.size > 10485760
  )

/* Alternative: Network-based detection via HTTP layer */
network where destination.port == 443 and
  /* HTTP/1.1 POST to i18n endpoint */
  url.path == "/ipa/i18n_messages" and http.request.method == "POST"

Splunk SPL Query

index=* sourcetype=apache:access OR sourcetype=apache_access
| where method="POST" AND uri_path="/ipa/i18n_messages"
| eval body_size = if(isnull(bytes), 0, bytes)
| where body_size > 10000000
| stats count by src_ip, uri_path, time
| sort - count

/* Alternative: Detect from HTTP raw events exploring response latency */
index=* sourcetype=apache:error
| where message LIKE "*i18n_messages*" AND (message LIKE "*memory*" OR message LIKE "*alloc*" OR message LIKE "*out of memory*")
| stats count by host, time

Wazuh OSSEC Rule

<group name="freeipa,">
  <rule id="100731" level="12">
    <decoded_as>apache-accesslog</decoded_as>
    <match>POST /ipa/i18n_messages</match>
    <regex>^\S+ \S+ \S+ \[[^\]]+\] "(?:POST) /ipa/i18n_messages[^"]*" \S+ (\S+)</regex>
    <description>CVE-2026-73198: Excessive request body to FreeIPA i18n endpoint (potential DoS).</description>
    <group>attack.t1499,cve.2026-73198,cwe.770,</group>
    <mitre>
      <id>T1499</id>
    </mitre>
    <options>no_full_log</options>
    <frequency>5</frequency>
    <timeframe>60</timeframe>
  </rule>

  <!-- Alert on very large content-length headers -->
  <rule id="100732" level="15">
    <decoded_as>apache-accesslog</decoded_as>
    <match>POST /ipa/i18n_messages</match>
    <regex>Content-Length: (\d+)</regex>
    <if_sid>100731</if_sid>
    <description>CVE-2026-73198: Confirmed large payload (over 10MB) sent to FreeIPA i18n endpoint.</description>
    <group>attack.t1499,cve.2026-73198,cwe.770,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 2/4 (CLAIMED — single source claims patch, not independently confirmed)

1) Immediate Mitigations

While awaiting an officially confirmed patch:

• Apply web server request size limits: Configure the HTTP server fronting FreeIPA (Apache httpd) to reject requests with bodies exceeding a reasonable threshold. Example in Apache config:

  LimitRequestBody 1048576  # 1 MB limit for /ipa/i18n_messages
  

  Apply this as a per-location directive:

  <Location /ipa/i18n_messages>
      LimitRequestBody 1048576
  </Location>
  

• Implement rate limiting: Deploy a reverse proxy (HAProxy, Nginx) or Web Application Firewall (WAF) rule that limits request rate per client IP to the /ipa/i18n_messages endpoint.
• Network-level filtering: If FreeIPA is not intended to be internet-facing, restrict access to the web interface to trusted networks only (RFC 1918 space). This drastically reduces the exposed attack surface.
• Monitor memory usage: Deploy alerting on the FreeIPA host for memory consumption anomalies. Alert if memory usage exceeds 80% sustained for more than 5 minutes.

2) Patch/Upgrade Steps

• Do not apply unverified patches: Because the patch source confidence is 2/4 (single-source claim), wait for official Red Hat Security Advisory. Applying a rumored patch without vendor confirmation could introduce instability.
• Monitor Red Hat Security Advisories: Check Red Hat Customer Portal (access.redhat.com) and Red Hat Security Errata for an advisory referencing CVE-2026-73198.
• Plan upgrade window: Once a confirmed patch is available, schedule an upgrade of FreeIPA packages across all replicas and the primary server. Test in a staging environment first, as FreeIPA upgrades can have significant operational impact.
• Check for package updates: For RHEL systems, run:

  yum check-update freeipa-server
  yum update freeipa-server
  

  After confirming the patched version in the advisory.

3) Long-Term Hardening

• Run FreeIPA behind a reverse proxy: Place a hardened reverse proxy with request inspection between the internet and FreeIPA. Configure max request body size at the proxy level.
• Network segmentation: Ensure FreeIPA servers are not directly exposed to untrusted networks. Place them in an internal, access-controlled segment.
• Web Application Firewall (WAF): Deploy a WAF with rules for request size limits, rate limiting, and known exploit patterns.
• Resource limits: Configure systemd service limits for the FreeIPA web process to prevent a single process from exhausting all host memory:

  # /etc/systemd/system/httpd.service.d/limits.conf
  [Service]
  MemoryMax=2G
  

• Implement DoS defense at the network layer: Use netfilter/iptables rate limiting or an external DoS protection service to absorb volumetric attacks.
• Regular security reviews: Periodically audit FreeIPA exposure (port scans, service fingerprinting) and apply the principle of least exposure.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-73198
2. Red Hat Security Advisory Portal: https://access.redhat.com/security/security-updates (search for CVE-2026-73198)
3. FreeIPA Project Homepage: https://www.freeipa.org/ (for version history and release notes)
4. MITRE ATT&CK T1499: https://attack.mitre.org/techniques/T1499/ (Endpoint Denial of Service)
5. CWE-770 Reference: https://cwe.mitre.org/data/definitions/770.html (Allocation of Resources Without Limits or Throttling)

Threat Actor Activity

As of this report:

• CISA KEV: Not listed
• Exploitation in the wild: No confirmed evidence
• Public PoC/Exploit code: None available
• Nuclei templates: Not available
• Threat actor campaigns: No known campaigns target this CVE

The absence of public exploit code and KEV listing suggests limited adversary attention to date, but the vulnerability's low exploitation complexity and unauthenticated nature make it a likely candidate for future inclusion in automated exploit frameworks. Security teams should remain vigilant and monitor Red Hat advisories for patch confirmation.