Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Fixed packages 26

Vulnerabilities 16

• High 8.7
  CVE-2026-26996

  minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern

  minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed…

  isaacs minimatch langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Feb 20, 2026
• High 8.7
  CVE-2026-40192

  Pillow is vulnerable to a FITS GZIP decompression bomb

  Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memo…

  python-pillow Pillow open-webui kubeflow-pipelines-visualization-server Debian Ubuntu Wolfi PyPI
  Apr 15, 2026
• High 8.2
  CVE-2026-39363 Public exploit Scanner template

  Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

  Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…

  vitejs vite vite-plus langfuse-3-worker Wolfi npm
  Apr 7, 2026
• High 7.5
  CVE-2026-27904

  minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

  minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g.…

  isaacs minimatch katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  Feb 26, 2026
• High 7.5
  CVE-2026-30922

  pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payl…

  pyasn1 pyasn1 kubeflow-pipelines-apiserver airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Mar 18, 2026
• High 7.5
  CVE-2026-32280

  Unexpected work during chain building in crypto/x509

  During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-32283

  Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

  If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-33891

  Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

  Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() func…

  Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  Mar 27, 2026
• High 7.5
  CVE-2026-33894

  Forge has signature forgery in RSA-PKCS due to ASN.1 extra field

  Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, RSASSA PKCS#1 v1.5 signature verification accepts forged signatures for low public exponent keys (e=3). Attackers can forge signatur…

  Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  Mar 27, 2026
• High 7.5
  CVE-2026-33895

  Forge has signature forgery in Ed25519 due to missing S > L check

  Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, Ed25519 signature verification accepts forged non-canonical signatures where the scalar S is not reduced modulo the group order (`S …

  Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  Mar 27, 2026
• High 7.5
  CVE-2026-4926

  path-to-regexp vulnerable to Denial of Service via sequential optional groups

  Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in ve…

  path-to-regexp path-to-regexp langfuse-3-worker vitess-23 Debian Wolfi npm
  Mar 26, 2026
• High 7.4
  CVE-2026-33896

  Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)

  Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, `pki.verifyCertificateChain()` does not enforce RFC 5280 basicConstraints requirements when an intermediate certificate lacks both t…

  Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  Mar 27, 2026
• High 7.2
  CVE-2026-7246

  [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

  This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vul…

  Pallets Click Click python-click python-click Debian Azure Linux
  Apr 30, 2026
• Medium 6.9
  CVE-2026-39892

  cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer o…

  pyca cryptography open-webui airflow-3 Debian Alpine Wolfi PyPI
  Apr 8, 2026
• Medium 6.4
  CVE-2026-32282

  TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

  On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…

  Go standard library internal/syscall/unix golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• Medium 6.3
  CVE-2025-62718

  Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF

  Axios is a promise based HTTP client for the browser and Node.js. Prior to 1.15.0 and 0.31.0, Axios does not correctly handle hostname normalization when checking NO_PROXY rules. Requests to loopback addresses like localhost. (with a trailing dot) or [::1] (I…

  axios axios langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Apr 9, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2441268
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448553
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2451867
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452450
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452458
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452464
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456179
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456339
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456913
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464121
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24761.json
• report
  https://access.redhat.com/security/cve/CVE-2025-62718
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-62718
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-62718
• article
  https://datatracker.ietf.org/doc/html/rfc1034#section-3.1
• article
  https://datatracker.ietf.org/doc/html/rfc3986#section-3.2.2
• article
  https://github.com/axios/axios/commit/fb3befb6daac6cad26b2e54094d0f2d9e47f24df
• article
  https://github.com/axios/axios/pull/10661
• article
  https://github.com/axios/axios/releases/tag/v1.15.0
• article
  https://github.com/axios/axios/security/advisories/GHSA-3p68-rc4w-qgx5
• report
  https://access.redhat.com/security/cve/CVE-2026-4926
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4926
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4926
• article
  https://cna.openjsf.org/security-advisories.html
• report
  https://access.redhat.com/security/cve/CVE-2026-7246
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-7246
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-7246
• article
  https://github.com/pallets/click/releases/tag/8.3.3
• article
  https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
• report
  https://access.redhat.com/security/cve/CVE-2026-26996