Executive brief
FreeIPA is an identity and access management system used to centrally manage user authentication and authorization in enterprise environments. An unauthenticated attacker can send oversized HTTP POST requests to the migration endpoint, forcing the server to read the entire request into memory and causing high memory consumption, slow request handling, and potential service unavailability.
Technical details
The vulnerability is an unbounded request body read in the `/ipa/migration/migration.py` endpoint. An unauthenticated, remote attacker can craft oversized form POST requests that force the migration handler to load the complete request body into memory without limits, leading to memory exhaustion and denial of service. The vulnerability is reachable without authentication and can be exploited over the network. No patch availability information is provided in the advisory text.
Affected products
- Red Hat FreeIPA <UNKNOWN>
Timeline
- 2026-08-20: disclosed
- 2026-09-23: advisory: Red Hat advisory RHSA-2026:70564 published