Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update
🔗 CVE IDs covered (2)
📋 Description
CVE-2026-48068 — grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema
🎯 Affected products2
- Red Hat Ansible Automation Platform 2.2
- registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64 as a component of Red Hat Ansible Automation Platform 2.2
✅ Remediation
For more about Ansible plugins for Red Hat Developer Hub, see References links Workaround: Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability. Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.
🔗 References (6)
- selfhttps://access.redhat.com/errata/RHSA-2026:50839
- externalhttps://access.redhat.com/security/cve/CVE-2026-48068
- externalhttps://access.redhat.com/security/cve/CVE-2026-59877
- externalhttps://access.redhat.com/security/updates/classification/
- externalhttps://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform
- selfhttps://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50839.json