CVE-2026-73199
Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value
A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Ipa: freeipa: null pointer dereference in `ipa-enrollment` extended operation (`join_oid`) via missing request value
A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
- Record
CVE-2026-73199- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-05
EUVDEUVD-2026-63246
A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
- Record
EUVD-2026-63246- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-06
GitHub AdvisoriesGHSA-mjqg-mjqw-9xv8
A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit...
A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
- Record
GHSA-mjqg-mjqw-9xv8- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-02
NVD
A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
- Record
CVE-2026-73199- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-476
- Updated
- 2026-11-06
OSVDEBIAN-CVE-2026-73199
A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
- Record
DEBIAN-CVE-2026-73199- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-07
OSVUBUNTU-CVE-2026-73199
A flaw was found in the ipa-enrollment SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the JOIN_OID in the ipa-enrollment extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
- Record
UBUNTU-CVE-2026-73199- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
freeipaDebian:12 |
All versions, plus listed versions 4.10.1+dfsg1-1+exp14.10.1-1+exp14.10.2-14.10.2-24.10.2-2+exp1 Show 14 moreShow less4.11.1-14.11.1-1+exp14.11.1-24.11.1-2+exp14.11.1-2.14.12.2-14.12.2-24.12.2-34.12.4-14.12.4-24.13.1-14.9.11-14.9.11-1+exp14.9.11-2 |
None known |
freeipaDebian:13 |
All versions, plus listed versions 4.12.4-14.12.4-24.13.1-1 |
None known |
freeipaDebian:14 |
All versions, plus listed versions 4.12.4-14.12.4-24.13.1-1 |
None known |
freeipaUbuntu:Pro:14.04:LTS |
All versions, plus listed versions 3.2.1-0ubuntu13.3.4-0ubuntu13.3.4-0ubuntu23.3.4-0ubuntu33.3.4-0ubuntu3.13.3.4-0ubuntu3.1+esm1 |
None known |
freeipaUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 4.1.4-14.3.1-0ubuntu14.3.1-0ubuntu1+esm1 |
None known |
freeipaUbuntu:18.04:LTS |
All versions, plus listed versions 4.4.4-3ubuntu14.4.4-44.7.0~pre1+git20180411-2ubuntu14.7.0~pre1+git20180411-2ubuntu2 |
None known |
freeipaUbuntu:20.04:LTS |
All versions, plus listed versions 4.8.1-2ubuntu14.8.3-14.8.6-1ubuntu2 |
None known |
freeipaUbuntu:22.04:LTS |
All versions, plus listed versions 4.8.6-1ubuntu64.8.6-1ubuntu84.8.6-1ubuntu94.9.8-1 |
None known |
freeipaUbuntu:24.04:LTS |
All versions, plus listed versions 4.10.2-14.10.2-24.10.2-2ubuntu34.11.1-14.11.1-2 |
None known |
freeipaUbuntu:26.10 |
All versions, plus listed versions 4.13.1-14.13.1-1build1 |
None known |
freeipaUbuntu:26.04:LTS |
All versions, plus listed versions 4.12.4-14.12.4-24.13.1-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | EUVD, NVD, OSV | |
| facts | CVE List | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-73199 is a medium vulnerability (CVSS 6.5) in Red Hat Enterprise Linux 10, published August 20, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.35%, the 29th percentile. No source names a fixed version.