RHSA-2026:13512HighCVSS 9.1

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Published
May 4, 2026
Last Modified
September 2, 2026

🔗 CVE IDs covered (12)

CVE-2025-69873 →CVE-2026-6266 →CVE-2026-25679 →CVE-2026-26007 →CVE-2026-27606 →CVE-2026-29074 →CVE-2026-32597 →CVE-2026-23490 →CVE-2026-27459 →CVE-2026-30922 →CVE-2026-39373 →CVE-2025-69534 →

📋 Description

CVE-2025-69534 — python-markdown: denial of service via malformed HTML-like sequences CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-6266 — aap-controller: aap-gateway: Account hijacking and unauthorized access via unverified email linking CVE-2026-23490 — pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-25679 — net/url: Incorrect parsing of IPv6 host literals in net/url CVE-2026-26007 — cryptography: cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves CVE-2026-27459 — pyOpenSSL: DTLS cookie callback buffer overflow CVE-2026-27606 — rollup: Rollup: Remote Code Execution via Path Traversal Vulnerability CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion CVE-2026-30922 — pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion CVE-2026-32597 — pyjwt: PyJWT accepts unknown crit header extensions (RFC 7515 §4.1.11 MUST violation) CVE-2026-39373 — JWCrypto: python-cryptography: python: JWCrypto: Memory exhaustion via crafted compressed JWE tokens

🎯 Affected products200

  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-core-1:2.16.18-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-core-1:2.16.18-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-core-1:2.16.18-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-core-1:2.16.18-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-lint-0:26.1.1-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-lint-0:26.1.1-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-lint-0:26.1.1-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-lint-0:26.1.1-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-test-1:2.16.18-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-test-1:2.16.18-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-0:4.6.28-3.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-0:4.6.28-3.el8ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-0:4.6.28-3.el8ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-0:4.6.28-3.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-0:4.6.28-3.el8ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-0:4.6.28-3.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-0:4.6.28-3.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-0:4.6.28-3.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-0:4.6.28-3.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-0:4.6.28-3.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-cli-0:4.6.28-3.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-cli-0:4.6.28-3.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-server-0:4.6.28-3.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-server-0:4.6.28-3.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-ui-0:4.6.28-3.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-ui-0:4.6.28-3.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • automation-controller-venv-tower-0:4.6.28-3.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • automation-controller-venv-tower-0:4.6.28-3.el8ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • +170 more not shown

✅ Remediation

For details on how to apply this update, refer to Ansible Automation Platform documentation. Workaround: To mitigate this vulnerability, wrap your markdown parsing function in a try/except block. This catches the unhandled exception, preventing both the application crash and the stack trace leak. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this flaw, ensure the callback provided to the set_cookie_generate_callback function strictly limits the returned cookie string or byte sequence to under 256 bytes. Workaround: To mitigate the risk of arbitrary file writes and remote code execution, ensure that build processes utilizing the Rollup module bundler are executed within a strictly controlled and isolated environment, such as a container with minimal privileges. Restrict the file system permissions of the user or service account running Rollup to only the directories absolutely necessary for its operation. Additionally, rigorously validate all inputs, including CLI arguments, manual chunk aliases, and third-party plugins, to prevent the introduction of malicious path traversal sequences.

🔗 References (17)