CVE-2026-73199

The ipa-enrollment plugin in FreeIPA contains a denial-of-service vulnerability in its JOIN_OID extended operation handler. When a client omits the optional JOIN_OID request value, the handler dereferences the missing field and crashes the directory server instead of gracefully rejecting the malformed request. This is a classic null-dereference vulnerability at a network protocol boundary—the plugin receives LDAP payloads from authenticated clients but was coded as if handling trusted internal calls. The CVSS 6.5 score materially understates operational risk. FreeIPA typically serves as the identity backbone for entire domains; a server crash does not merely knock out one service—it simultaneously breaks LDAP authentication for every dependent workload. A single authenticated user can trigger this. This vulnerability genotype is not novel. CVE-2015-5466 in 389-ds (FreeIPA's upstream) involved an identical pattern: malformed LDAP extended operations causing null dereferences in SLAPI plugins. The upstream fix was merged nearly a decade ago, yet this same defect reappeared in the ipa-enrollment plugin. The historical pattern suggests other extended operation handlers in this plugin or similar plugins may exhibit the same unchecked optional-field behavior. Prioritize auditing other OIDs in the ipa-enrollment plugin for missing input guards. Examine the actual patch diff to determine whether this was fixed with a simple null check or whether structural input validation was added—if it's only the former, treat other handlers in this plugin as likely vulnerable until proven otherwise. The JOIN_OID crash is DoS, but the next handler with this pattern might touch more sensitive operations than enrollment.

Reviewed through automated stages and approved by a human before publication.