Bug 2529709 (CVE-2026-86593)

A flaw was found in FreeIPA. The public session endpoints `login_password`, `change_password`, and `sync_token` in `ipaserver/rpcserver.py` call `read_input()` without passing `MAX_REQUEST_BODY_SIZE`, unlike `jsonserver_i18n_messages` (fixed under CVE-2026-73198), so the full declared request body is read into memory before any credential/token validation occurs. The shipped Apache configuration (`install/share/ipa.conf.template`) exposes all three endpoints without authentication via `Satisfy Any` / `Require all granted`, overriding the parent `/ipa` location's `Require valid-user` rule. The default `RequestReadTimeout ... body=30,MinRate=500` slowloris protection in the same configuration does not prevent exploitation: an attacker needs only as many concurrent connections sustaining a trivial ~500 B/s as there are configured WSGI worker processes to occupy the entire shared `WSGIDaemonProcess ipa` pool (confirmed: `threads=1` per process), or alternatively can send a large body at full network speed to bypass the rate check entirely. Because that worker pool is shared by the whole `/ipa` WSGI application, exhausting it denies all IPA HTTP functionality, including the GSSAPI/Kerberos-authenticated paths (WebUI, admin RPC), not only other unauthenticated requests.

This is a distinct instance of the same root-cause class already fixed for `i18n_messages` (CVE-2026-73198) and `/ipa/migration/migration.py` (CVE-2026-73197); the fix for CVE-2026-73198 was scoped only to that single caller and left this defect present in the three session endpoints, contrary to that fix commit's stated assumption that they require authentication.

Reproduced independently in an isolated sandbox against the real, unmodified installed FreeIPA package (freeipa-server-4.12.2-4.fc40): the actual `read_input()` accepted and returned a 64 MiB body with zero rejection in ~0.07s, and the real shipped `/usr/share/ipa/ipa.conf.template` was confirmed to contain the exact `Satisfy Any` / `Require all granted` blocks for all three session locations plus `WSGIDaemonProcess ipa processes=$WSGI_PROCESSES threads=1`.