Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Fixed packages 41

Vulnerabilities 12

• High 8.7
  CVE-2026-40192

  Pillow is vulnerable to a FITS GZIP decompression bomb

  Pillow is a Python imaging library. Versions 10.3.0 through 12.1.1 did not limit the amount of GZIP-compressed data read when decoding a FITS image, making them vulnerable to decompression bomb attacks. A specially crafted FITS file could cause unbounded memo…

  python-pillow Pillow open-webui kubeflow-pipelines-visualization-server Debian Ubuntu Wolfi PyPI
  Apr 15, 2026
• High 8.2
  CVE-2026-39363 Public exploit Scanner template

  Vite Affected by Arbitrary File Read via Vite Dev Server WebSocket

  Vite is a frontend tooling framework for JavaScript. From 6.0.0 to before 6.4.2, 7.3.2, and 8.0.5, if it is possible to connect to the Vite dev server’s WebSocket without an Origin header, an attacker can invoke fetchModule via the custom WebSocket event vite…

  vitejs vite vite-plus langfuse-3-worker Wolfi npm
  Apr 7, 2026
• High 8.1
  CVE-2026-4800 Public exploit

  lodash vulnerable to Code Injection via `_.template` imports key names

  The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

  lodash lodash lodash-es lodash-amd Debian Ubuntu Wolfi npm
  Mar 31, 2026
• High 7.5
  CVE-2026-30922

  pyasn1 Vulnerable to Denial of Service via Unbounded Recursion

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the `pyasn1` library is vulnerable to a Denial of Service (DoS) attack caused by uncontrolled recursion when decoding ASN.1 data with deeply nested structures. An attacker can supply a crafted payl…

  pyasn1 pyasn1 kubeflow-pipelines-apiserver airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Mar 18, 2026
• High 7.5
  CVE-2026-32280

  Unexpected work during chain building in crypto/x509

  During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 an…

  Go standard library crypto/x509 golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-32283

  Unauthenticated TLS 1.3 KeyUpdate record can cause persistent connection retention and DoS in crypto/tls

  If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

  Go standard library crypto/tls golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• High 7.5
  CVE-2026-33891

  Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input

  Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.4.0, a Denial of Service (DoS) vulnerability exists in the node-forge library due to an infinite loop in the BigInteger.modInverse() func…

  Digital Bazaar forge katib-suggestion-hyperopt katib-earlystopping Ubuntu Wolfi npm
  Mar 27, 2026
• High 7.5
  CVE-2026-4926

  path-to-regexp vulnerable to Denial of Service via sequential optional groups

  Impact: A bad regular expression is generated any time you have multiple sequential optional groups (curly brace syntax), such as `{a}{b}{c}:z`. The generated regex grows exponentially with the number of groups, causing denial of service. Patches: Fixed in ve…

  path-to-regexp path-to-regexp langfuse-3-worker vitess-23 Debian Wolfi npm
  Mar 26, 2026
• High 7.2
  CVE-2026-7246

  [DISPUTED] Pallets Click contains a command injection via Unsanitized Filename "click.edit()"

  This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vul…

  Pallets Click Click python-click python-click Debian Azure Linux
  Apr 30, 2026
• Medium 6.9
  CVE-2026-39892

  cryptography has a buffer overflow if non-contiguous buffers were passed to APIs

  cryptography is a package designed to expose cryptographic primitives and recipes to Python developers. From 45.0.0 to before 46.0.7, if a non-contiguous buffer was passed to APIs which accepted Python buffers (e.g. Hash.update()), this could lead to buffer o…

  pyca cryptography open-webui airflow-3 Debian Alpine Wolfi PyPI
  Apr 8, 2026
• Medium 6.4
  CVE-2026-32282

  TOCTOU permits root escape on Linux via Root.Chmod in os in internal/syscall/unix

  On Linux, if the target of Root.Chmod is replaced with a symlink while the chmod operation is in progress, Chmod can operate on the target of the symlink, even when the target lies outside the root. The Linux fchmodat syscall silently ignores the AT_SYMLINK_N…

  Go standard library internal/syscall/unix golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Apr 8, 2026
• Medium 4.8
  CVE-2026-40175 Public exploit

  Axios has Unrestricted Cloud Metadata Exfiltration via Header Injection Chain

  Axios is a promise based HTTP client for the browser and Node.js. Versions prior to 1.15.0 and 0.3.1 are vulnerable to a specific gadget-style attack chain in which prototype pollution in a third-party dependency may be leveraged to inject unsanitized header …

  axios axios langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Apr 10, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/whats_new-async_updates
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2448553
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2451867
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2452450
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2453496
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456179
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456336
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456339
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2456735
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2457432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2458856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2464121
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24762.json
• report
  https://access.redhat.com/security/cve/CVE-2026-4800
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4800
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4800
• article
  https://cna.openjsf.org/security-advisories.html
• article
  https://github.com/lodash/lodash/security/advisories/GHSA-r5fr-rjxr-66jc
• report
  https://access.redhat.com/security/cve/CVE-2026-4926
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-4926
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-4926
• report
  https://access.redhat.com/security/cve/CVE-2026-7246
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-7246
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-7246
• article
  https://github.com/pallets/click/releases/tag/8.3.3
• article
  https://github.com/tsigouris007/security-advisories/security/advisories/GHSA-47fr-3ffg-hgmw
• report
  https://access.redhat.com/security/cve/CVE-2026-30922
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-30922
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-30922
• article
  https://github.com/pyasn1/pyasn1/commit/25ad481c19fdb006e20485ef3fc2e5b3eff30ef0
• article
  https://github.com/pyasn1/pyasn1/security/advisories/GHSA-jr27-m4p2-rc6r
• report
  https://access.redhat.com/security/cve/CVE-2026-32280
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-32280
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-32280
• article
  https://go.dev/cl/758320
• article
  https://go.dev/issue/78282