{"id":"CVE-2026-73196","title":"Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding","summary":"A flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, co…","severity":"medium","cvss":4.3,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L","cvssSource":"cna","cwe":["CWE-770"],"vendor":"Red Hat","product":"ipa","affected":["ipa (all versions)","ipa","ipa (all versions)","ipa (all versions)","ipa (all versions)"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-08-20T14:18:49.811170Z"},"published":"2026-08-20","updated":"2026-11-05","sourceUpdated":"2026-11-05T22:41:30.871Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-73196","references":[{"url":"https://access.redhat.com/security/cve/CVE-2026-73196"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2474712","label":"RHBZ#2474712"}],"tags":["cve.org"],"epss":0.00426,"epssPercentile":0.37057,"ingestedAt":"2026-11-05T23:41:31.944Z","slug":"CVE-2026-73196","body":"## Overview\n\nA flaw was found in FreeIPA. A low-privilege authenticated user can exploit this vulnerability by submitting an oversized One-Time Password (OTP) key value. This oversized key is then decoded and re-encoded without proper size limits, consuming excessive CPU and memory resources. This can lead to a denial of service, degrading the availability of the IPA service.\n\n## Affected\n\n- `ipa (all versions)`\n- `ipa`\n- `ipa (all versions)`\n- `ipa (all versions)`\n- `ipa (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n### Workarounds\n\nTo mitigate this issue, enforce conservative HTTP request-body limits on the `/ipa/session/json` endpoint to reject oversized payloads before they reach the vulnerable IPA parameter conversion. Additionally, if operationally feasible, restrict self-managed token creation to trusted users and implement monitoring or rate-limiting for repeated large authenticated requests. Changes to HTTP server configurations or FreeIPA permissions may require service restarts or reloads to take effect.","depth":"sunlit","depthScore":24,"depthScoreParts":{"impact":23.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}