RHSA-2026:51162HighCVSS 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update

Published
August 6, 2026
Last Modified
August 20, 2026

🔗 CVE IDs covered (7)

CVE-2026-44902 →CVE-2026-45740 →CVE-2026-48068 →CVE-2026-48801 →CVE-2026-59873 →CVE-2026-59877 →CVE-2026-13149 →

📋 Description

CVE-2026-13149 — brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity CVE-2026-44902 — opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request CVE-2026-45740 — protobufjs: protobufjs: Denial of Service via crafted JSON descriptors CVE-2026-48068 — grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation CVE-2026-48801 — linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability CVE-2026-59873 — tar: node-tar: Denial of Service via crafted gzip bomb CVE-2026-59877 — protobufjs: protobufjs: Denial of Service via crafted .proto schema

🎯 Affected products2

  • Red Hat Ansible Automation Platform 2.2
  • registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64 as a component of Red Hat Ansible Automation Platform 2.2

✅ Remediation

For more about Ansible Portal Installer Bootc, see References links Workaround: There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service. Workaround: Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability. Workaround: Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.

🔗 References (11)