Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Fixed packages 12

Vulnerabilities 6

• High 8.9
  CVE-2025-66471

  urllib3 Streaming API improperly handles highly compressed data

  urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by readi…

  urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Dec 5, 2025
• High 8.2
  CVE-2025-4565

  Unbounded recursion in Python Protobuf

  Any project that uses Protobuf Pure-Python backend to parse untrusted Protocol Buffers data containing an arbitrary number of recursive groups, recursive messages or a series of SGROUP tags can be corrupted by exceeding the Python recursion limit. This can re…

  Protocol Buffers Python-Protobuf kserve-storage-controller kserve-agent Debian Ubuntu Azure Linux Wolfi PyPI
  Jun 16, 2025
• High 7.5
  CVE-2025-61729

  Excessive resource consumption when printing error string for host certificate validation in crypto/x509

  Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out. Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime. Therefore, a certi…

  Go standard library crypto/x509 katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Dec 2, 2025
• High 7.5
  CVE-2025-64460

  Potential denial-of-service vulnerability in XML serializer text extraction

  An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. Algorithmic complexity in `django.core.serializers.xml_serializer.getInnerText()` allows a remote attacker to cause a potential denial-of-service attack triggering CPU and …

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Dec 2, 2025
• High 7.5
  CVE-2025-69223

  AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by A…

  aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 5, 2026
• Low 1.7
  CVE-2025-53643

  AIOHTTP is vulnerable to HTTP Request/Response Smuggling through incorrect parsing of chunked trailer sections

  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.12.14, the Python parser is vulnerable to a request smuggling vulnerability due to not parsing trailer sections of an HTTP request. If a pure Python version of …

  aio-libs aiohttp airflow-3 py3-cassandra-medusa Debian Ubuntu Azure Linux Wolfi PyPI
  Jul 14, 2025

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2373016
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2380000
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2418462
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2419467
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2427456
• article
  https://issues.redhat.com/browse/AAP-60364
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1249.json
• report
  https://access.redhat.com/security/cve/CVE-2025-4565
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-4565
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-4565
• article
  https://github.com/protocolbuffers/protobuf/commit/17838beda2943d08b8a9d4df5b68f5f04f26d901
• report
  https://access.redhat.com/security/cve/CVE-2025-53643
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-53643
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-53643
• article
  https://github.com/aio-libs/aiohttp/commit/e8d774f635dc6d1cd3174d0e38891da5de0e2b6a
• article
  https://github.com/aio-libs/aiohttp/security/advisories/GHSA-9548-qrrj-x5pj
• report
  https://access.redhat.com/security/cve/CVE-2025-61729
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-61729
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-61729
• article
  https://go.dev/cl/725920
• article
  https://go.dev/issue/76445
• article
  https://groups.google.com/g/golang-announce/c/8FJoBkPddm4
• advisory
  https://pkg.go.dev/vuln/GO-2025-4155
• report
  https://access.redhat.com/security/cve/CVE-2025-64460
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-64460
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-64460
• article
  https://docs.djangoproject.com/en/dev/releases/security/
• article
  https://groups.google.com/g/django-announce
• article
  https://www.djangoproject.com/weblog/2025/dec/02/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2025-66471
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-66471
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-66471
• article
  https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7
• article
  https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37
• report
  https://access.redhat.com/security/cve/CVE-2025-69223