CVE-2026-73199 in Red Hat
Summary
by MITRE • 08/20/2026
A flaw was found in the `ipa-enrollment` SLAPI plugin. A remote authenticated client can exploit a null pointer dereference vulnerability by sending a malformed Lightweight Directory Access Protocol (LDAP) extended operation. By omitting the request value for the `JOIN_OID` in the `ipa-enrollment` extended operation, an attacker can trigger a server crash, potentially causing a denial of service.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 08/20/2026
The identified vulnerability resides within the ipa-enrollment SLAPI plugin, which is a critical component responsible for handling enrollment requests in Identity Management environments that utilize LDAP-based authentication and directory services. This specific flaw manifests as a null pointer dereference triggered by remote authenticated clients sending malformed Lightweight Directory Access Protocol extended operations. The technical root cause lies in insufficient input validation within the processing logic of the ipa-enrollment plugin, specifically concerning the JOIN_OID parameter. When an attacker constructs an LDAP extended operation request that omits the required value for JOIN_OID, the application fails to properly check for null references before attempting to access or process this missing data structure. This lack of defensive programming leads directly to a segmentation fault or similar memory violation within the server process, resulting in an immediate crash of the affected service component.
From an operational perspective, this vulnerability poses a significant risk as it enables a remote denial of service attack against identity management infrastructure. Although exploitation requires authentication, meaning the attacker must possess valid credentials for the directory service, the ability to trigger a server crash with minimal effort undermines the availability and reliability of critical identity services. In enterprise environments where LDAP servers handle user authentication, authorization, and account management across numerous applications and systems, an outage can disrupt business operations, prevent users from logging in, and halt automated processes that rely on directory queries for provisioning or access control decisions. The impact is particularly severe because the crash affects the core service rather than a peripheral application, potentially requiring manual intervention to restart services and restore normal functionality.
This vulnerability aligns with CWE-476, which describes a NULL Pointer Dereference error where software dereferences a null pointer resulting in an unintended termination or crash of the program. Furthermore, from a tactical standpoint within the MITRE ATT&CK framework, this exploit falls under the category of Denial of Service (T1499), specifically utilizing endpoint denial of service techniques to disrupt availability. The attack vector is classified as Network with Authentication requirements, indicating that while it can be executed remotely over standard LDAP ports such as 389 or 636, it necessitates prior compromise or theft of valid credentials. This highlights the importance of not only securing network access but also implementing strict input validation and error handling within application logic to prevent exploitation even by authenticated users who may have limited privileges.
To mitigate this vulnerability, immediate patching is required through the distribution of updated packages that address the null pointer check in the ipa-enrollment plugin. Administrators should ensure that all Identity Management servers are running versions where this specific input validation flaw has been resolved. In addition to software updates, organizations should implement network-level access controls such as firewalls or intrusion prevention systems to restrict LDAP traffic to only authorized IP addresses and subnets, thereby reducing the attack surface for authenticated attacks. Furthermore, deploying monitoring solutions that detect abnormal spikes in error logs or service restarts can help identify potential exploitation attempts early. Regular security audits focusing on input validation practices across all directory service plugins are also recommended to prevent similar null pointer dereference issues from arising in other components of the identity infrastructure.