RHSA-2026:6277HighCVSS 7.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Published
March 31, 2026
Last Modified
September 5, 2026

🔗 CVE IDs covered (7)

CVE-2025-68121 →CVE-2025-69873 →CVE-2026-25639 →CVE-2026-25990 →CVE-2026-27904 →CVE-2026-29074 →CVE-2025-61726 →

📋 Description

CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-68121 — crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-69873 — ajv: ReDoS via $data reference CVE-2026-25639 — axios: Axios affected by Denial of Service via proto Key in mergeConfig CVE-2026-25990 — pillow: Pillow: Out-of-bounds Write via Specially Crafted PSD Image CVE-2026-27904 — minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions CVE-2026-29074 — svgo: SVGO: Denial of Service via XML entity expansion

🎯 Affected products136

  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:0.6.3-3.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:0.6.3-3.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:0.6.3-3.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:0.6.3-3.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • aap-metrics-utility-0:0.6.3-3.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-automation-platform-installer-0:2.6-6.1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-automation-platform-installer-0:2.6-6.1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-core-1:2.16.17-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-core-1:2.16.17-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-core-2:2.16.17-2.el10ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-core-2:2.16.17-2.el10ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • ansible-rulebook-0:1.2.2-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-rulebook-0:1.2.2-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • ansible-test-1:2.16.17-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-0:4.7.10-2.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-0:4.7.10-2.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-0:4.7.10-2.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-0:4.7.10-2.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-0:4.7.10-2.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-cli-0:4.7.10-2.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-server-0:4.7.10-2.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-ui-0:4.7.10-2.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-venv-tower-0:4.7.10-2.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-venv-tower-0:4.7.10-2.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-venv-tower-0:4.7.10-2.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-controller-venv-tower-0:4.7.10-2.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-eda-controller-0:1.2.7-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • automation-eda-controller-0:1.2.7-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • +106 more not shown

✅ Remediation

For details on how to apply this update, refer to Ansible Automation Platform documentation. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: To mitigate this issue, disable the $data feature if your application does not require it. If $data must be used, implement strict validation of the input fields that are referenced by the pattern keyword to ensure they contain only expected and safe characters. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

🔗 References (12)