CVE-2026-73197

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit this vulnerability by sending oversized form POST requests to the `/ipa/migration/migration.py` endpoint. This can force the migration handler to read attacker-controlled request bodies fully into memory, leading to increased memory usage, slower request handling, and potential service disruption or denial of service.

• CWE-770

• https://access.redhat.com/errata/RHSA-2026:70564
• https://access.redhat.com/security/cve/CVE-2026-73197Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=2474697Issue Tracking, Vendor Advisory

Published

Aug 20, 2026

Last Modified

Sep 24, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-73191URL Redirection to Untrusted Site ('Open Redirect') vulnerab…6.1
• CVE-2026-73192An improper neutralization of input during web page generati…6.1
• CVE-2026-73193DBI versions before 1.652 for Perl allow a heap out-of-bound…9.8
• CVE-2026-73194DBI versions before 1.652 for Perl allow a heap out-of-bound…9.1
• CVE-2026-73195Improper Encoding or Escaping of Output vulnerability in Apa…7.3
• CVE-2026-73196A flaw was found in FreeIPA. A low-privilege authenticated u…6.5
• CVE-2026-73198A flaw was found in FreeIPA. A remote, unauthenticated attac…7.5
• CVE-2026-73199A flaw was found in the `ipa-enrollment` SLAPI plugin. A rem…6.5
• CVE-2026-7320Information disclosure due to incorrect boundary conditions …7.5
• CVE-2026-73208An attacker that holds a token intended for a different purp…7.4
• CVE-2026-73209An attacker that has valid credentials can send crafted comp…6.5
• CVE-2026-7321Sandbox escape due to incorrect boundary conditions in the W…9.6