Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Fixed packages 52

Vulnerabilities 12

• High 8.8
  CVE-2026-27606 Public exploit

  Rollup 4 has Arbitrary File Write via Path Traversal

  Rollup is a module bundler for JavaScript. Versions prior to 2.80.0, 3.30.0, and 4.59.0 of the Rollup module bundler (specifically v4.x and present in current source) is vulnerable to an Arbitrary File Write via Path Traversal. Insecure file name sanitization…

  rollup rollup langfuse-3-worker langfuse-3 Debian Ubuntu Wolfi npm
  Feb 25, 2026
• High 8.3
  CVE-2026-6266

  Aap-controller: aap-gateway: account hijacking and unauthorized access via unverified email linking

  A flaw was found in the AAP gateway. The user auto-link strategy, introduced in AAP 2.6, automatically links an external Identity Provider (IDP) identity to an existing AAP user account based on email matching without verifying email ownership. This allows a …

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.6
  May 4, 2026
• High 8.2
  CVE-2026-26007

  cryptography Subgroup Attack Due to Missing Subgroup Validation for SECT Curves

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. Prior to 46.0.5, the public_key_from_numbers (or EllipticCurvePublicNumbers.public_key()), EllipticCurvePublicNumbers.public_key(), load_der_public_key() a…

  pyca cryptography open-webui kubeflow-pipelines-apiserver Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Feb 10, 2026
• High 7.5
  CVE-2025-69534

  Python-Markdown version 3.8 contain a vulnerability where malformed HTML-like sequences can cause html.parser.HTMLParse…

  python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Wolfi PyPI
  Mar 5, 2026
• High 7.5
  CVE-2026-23490

  pyasn1 has a DoS vulnerability in decoder

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

  pyasn1 pyasn1 open-webui katib-earlystopping Debian Ubuntu Wolfi PyPI
  Jan 16, 2026
• High 7.5
  CVE-2026-25679

  Incorrect parsing of IPv6 host literals in net/url

  url.Parse insufficiently validated the host/authority component and accepted some invalid URLs.

  Go standard library net/url langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Mar 6, 2026
• High 7.5
  CVE-2026-29074

  SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

  SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities,…

  svg svgo vitess-23 svgo Debian Wolfi npm
  Mar 6, 2026
• High 7.5
  CVE-2026-30922

  pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payl…

  pyasn1 pyasn1 kubeflow-pipelines-apiserver airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Mar 18, 2026
• High 7.5
  CVE-2026-32597

  PyJWT accepts unknown `crit` header extensions (RFC 7515 §4.1.11 MUST violation)

  PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit (Critical) Header Parameter defined in RFC 7515 §4.1.11. When a JWS token contains a crit array listing extensions that PyJWT does not understand, the librar…

  jpadilla pyjwt open-webui airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Mar 12, 2026
• High 7.2
  CVE-2026-27459

  pyOpenSSL DTLS cookie callback buffer overflow

  pyOpenSSL is a Python wrapper around the OpenSSL library. Starting in version 22.0.0 and prior to version 26.0.0, if a user provided callback to `set_cookie_generate_callback` returned a cookie value greater than 256 bytes, pyOpenSSL would overflow an OpenSSL…

  pyca pyopenssl airflow-3 py3-cassandra-medusa Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Mar 17, 2026
• Medium 5.3
  CVE-2026-39373

  JWCrypto: JWE ZIP decompression bomb

  JWCrypto implements JWK, JWS, and JWE specifications using python-cryptography. Prior to 1.5.7, an unauthenticated attacker can exhaust server memory by sending crafted JWE tokens with ZIP compression. The existing patch for CVE-2024-28102 limits input token …

  Latchset jwcrypto python-jwcrypto python-jwcrypto Debian Ubuntu Azure Linux Wolfi PyPI
  Apr 7, 2026
• Low 2.9
  CVE-2025-69873

  ajv has ReDoS when using `$data` option

  ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to t…

  ajv.js ajv langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Feb 11, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2430472
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2438762
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439070
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442530
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2444839
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445132
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445356
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2447194
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448553
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456187
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458142
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_13512.json
• report
  https://access.redhat.com/security/cve/CVE-2025-69534
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-69534
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-69534
• article
  https://github.com/Python-Markdown/markdown
• article
  https://github.com/Python-Markdown/markdown/actions/runs/15736122892
• article
  https://github.com/Python-Markdown/markdown/issues/1534
• report
  https://access.redhat.com/security/cve/CVE-2025-69873
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-69873
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-69873
• article
  https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md
• report
  https://access.redhat.com/security/cve/CVE-2026-6266
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-6266
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-6266
• report
  https://access.redhat.com/security/cve/CVE-2026-23490
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-23490
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-23490
• article
  https://github.com/pyasn1/pyasn1/commit/3908f144229eed4df24bd569d16e5991ace44970
• article
  https://github.com/pyasn1/pyasn1/releases/tag/v0.6.2
• article
  https://github.com/pyasn1/pyasn1/security/advisories/GHSA-63vm-454h-vhhq
• report
  https://access.redhat.com/security/cve/CVE-2026-25679
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25679
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25679
• article
  https://go.dev/cl/752180