CVE-2026-73197

CVE-2026-73197 exposes a memory exhaustion vulnerability in FreeIPA's `/ipa/migration/migration.py` endpoint that reads attacker-controlled request bodies fully into memory without size limits. The CVSS 7.5 score fundamentally misrepresents the actual risk because it treats this as an isolated DoS finding rather than a failure in an identity provider that serves as the authentication backbone for entire enterprise realms. An attacker doesn't need credentials, a session, or prior access — they simply need to reach the endpoint and send oversized payloads. The critical question is whether this endpoint is exposed to untrusted networks by default. FreeIPA traditionally deploys internally, but 'internal network' is a deployment assumption, not a security control. If monitoring agents, backup systems, or adjacent infrastructure sit in the same network segment, an attacker compromising any of those systems gains direct access to this unprotected endpoint. The vulnerability description provides no guidance on network exposure, creating documentation debt that will propagate into misconfigured deployments. The substantive gap: does the fix impose size limits specifically on the migration handler, or does it enforce them at a framework level that protects all pre-authentication endpoints? An endpoint-specific patch addresses a symptom — a framework-level fix suggests the organization traced the failure to its architectural source. Either way, resource limits alone are insufficient. The migration endpoint's relevance decays over time; it's a transitional tool that becomes forgotten code sitting exposed for years after initial deployment. The fix should include explicit guidance that this endpoint should be network-segmented to only systems actively involved in migration, with a recommendation to disable it entirely post-migration. If you deploy FreeIPA: verify the migration endpoint's network accessibility immediately, apply any available interim mitigations such as WAF rules or reverse-proxy body-size limits, and treat this endpoint as a tier-one control requiring network isolation — not an implementation detail left to default deployment assumptions.

Reviewed through automated stages and approved by a human before publication.