Red Hat IPA CVE-2026-73197 Unauthenticated Remote DoS via /ipa/migration with PoC

Vulnerability Overview Vulnerability ID: Bug 2474697 (CVE-2026-73197) Vulnerability Type: Unauthenticated Denial of Service (DoS) Description: An unauthenticated DoS vulnerability in allows attackers to exhaust server memory by sending large POST requests via unrestricted request body reading, leading to service degradation. Component: module Affected Version: Scope Operating System: Linux Priority: High Severity: High Target Milestone: Not specified Assigned To: Product Security Team QA Contact: Not specified Doc Contact: Not specified URL: Not specified Whitelist: Not specified Dependencies: 2530171 Blocking: Not specified View/Edit: Not specified Remediation Patch Availability: No fix package published; patch established. Fixed Version: Unknown Upstream Coordination: Not notified CVSS: 3.3/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (MEDIUM) ACL: Exploitation requires sending an oversized POST request; no special preconditions required to establish. PR: The endpoint is reachable via the exposed migration endpoint. UI: No user interaction required. S: Impact is confined to the security scope of the vulnerable service. C: Confidentiality impact not established. I: Integrity impact not established. A: Memory pressure and service degradation impacts are established. Impact: Significant. Red Hat Guidance classification identifies this as a vulnerability allowing remote users to cause service unavailability. This code constitutes a remote, unauthenticated availability vulnerability targeting the web migration endpoint. Code execution or confidentiality/integrity impacts are not established in the migration configuration, although hardening external reverse proxies or HTTP servers may reduce exploitability. Mitigation: If the migration endpoint is not required, disable or unpublish . Otherwise, enforce conservative request body size limits at the HTTP frontend to reject oversized POST requests before they reach the WSGI script. POC Code Additional Information Reporter: OSIDB Bzimport Reported Date: 2026-05-11 21:56:53 UTC Modified Date: 2026-08-20 10:16:16 UTC CC List: 6 users (show) Fixed Version: Not specified Clone: Not specified Environment: Not specified Last Closed: Not specified Embedded: Not specified Attachments OSIDB Bzimport: 2026-05-11 21:56:53 UTC Comments Christopher Lusk: 2026-06-26 17:05:49 UTC - Tracker filed for rhel-10.3: https://issues.redhat.com/browse/RHEL-189996 Notes Login is required to comment or make changes here. --- Privacy

Goal Reached Thanks to every supporter — we hit 100%!

Red Hat IPA CVE-2026-73197 Unauthenticated Remote DoS via /ipa/migration with PoC