CVE-2026-73199Medium· 6.5▾ TwilightPoC availableA flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 35.8 · likelihood 0.1 · exploitation 12
A public proof-of-concept already exists for this vulnerability — see Exploit availability below.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.4%
A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
ipa (all versions)ipaipa (all versions)ipa (all versions)ipa (all versions)Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Restrict network access to the LDAP service to trusted clients only. This can be achieved by configuring firewall rules to allow connections only from known, trusted IP addresses or subnets, thereby limiting the ability of authenticated attackers to send malformed extended operations. If host enrollment functionality is not required, disabling the ipa-enrollment SLAPI plugin can remove this attack surface.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-76578Critical· 9.8A flaw was found in FreeIPA
CVE-2026-73196Medium· 4.3Ipa: freeipa: authenticated dos in `otptoken-add` via unbounded otp key decoding/re-encoding
CVE-2026-119728Medium· 6.5Gst-plugins-bad: gst-plugins-bad: null pointer dereference in h.264 mvc sps cleanup during parse failure
CVE-2026-119842Medium· 6.5Gst-plugins-base: gst-plugins-base: null-pointer dereference in mdvdsub subtitle parser via missing closing-brace check
CVE-2023-5455Medium· 6.5Ipa: invalid csrf protection
CVE-2026-117548Medium· 6.5389-ds-base: 389-ds-base: null pointer dereference via modifydn using an attribute's schema alias name causes denial of service