Description

A flaw was found in FreeIPA. A remote, unauthenticated attacker can exploit a vulnerability in the `/ipa/i18n_messages` endpoint by sending an arbitrarily large request body. This can cause the service to consume excessive memory, leading to memory exhaustion, degraded responsiveness, and a denial of service (DoS) condition.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-08-20T11:16:21.687Z",
  "pubdate": "2026-08-20T11:16:21.687Z",
  "executiveSummary": "A denial of service vulnerability has been identified in FreeIPA, specifically within the internationalization message handling functionality. The flaw enables a remote, unauthenticated attacker to exhaust server memory by transmitting an arbitrarily large request body to a targeted endpoint. Successful exploitation of this vulnerability results in severe resource consumption, leading to degraded system responsiveness and a complete denial of service condition for dependent identity management operations.\nThe affected product is FreeIPA, with the vulnerable component exposed via the HTTP interface. The risk implication is high due to the lack of authentication requirements, allowing any network-adjacent or remote attacker with HTTP access to disrupt core authentication and authorization services without prior system access. Mitigation requires applying vendor-supplied patches or implementing strict input size limits at the web server or reverse proxy layer to prevent the ingestion of excessively large payloads into the vulnerable application logic.",
  "technicalDetails": "The vulnerability resides in the HTTP endpoint /ipa/i18n_messages within FreeIPA, which is responsible for processing internationalization messages. The root cause of the vulnerability stems from insufficient input validation and unbounded memory allocation when parsing incoming HTTP request bodies. Specifically, the application fails to enforce appropriate size constraints or implement streaming ingestion mechanisms for payloads directed at the vulnerable endpoint.\nThe attack flow proceeds as follows: an unauthenticated remote attacker crafts an HTTP request targeting the /ipa/i18n_messages endpoint. The attacker populates the request body with an arbitrarily large payload. Upon receipt, the FreeIPA web application attempts to read, buffer, and process the entire incoming request body into memory simultaneously. Because the application lacks protective bounding checks on the expected input size, the unbounded allocation rapidly consumes available system memory.\nAs memory resources are exhausted, the operating system's out-of-memory handler may terminate processes, or the Python application runtime experiences severe garbage collection overhead and paging. This manifests operationally as memory exhaustion, heavily degraded service responsiveness, and an eventual denial of service condition affecting the availability of the FreeIPA server. The network exposure is remote, and the exploitation vector requires no privileges or authentication, increasing the ease with which malicious actors can disrupt targeted environments."
}