Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Fixed packages 52

Vulnerabilities 11

• High 8.2
  CVE-2026-0994 Public exploit

  Denial of Service in Python Protobuf

  A denial-of-service (DoS) vulnerability exists in google.protobuf.json_format.ParseDict() in Python, where the max_recursion_depth limit can be bypassed when parsing nested google.protobuf.Any messages. Due to missing recursion depth accounting inside the int…

  Python Protobuf mysql open-webui Debian Ubuntu Azure Linux Wolfi PyPI
  Jan 23, 2026
• High 8.0
  CVE-2026-22029

  React Router vulnerable to XSS via Open Redirects

  React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0, React Router (and Remix v1/v2) SPA open navigation redirects originating from loaders or actions in Framework Mode, Data Mode, or the unsta…

  remix-run react-router @remix-run/router react-router npm
  Jan 10, 2026
• High 7.5
  CVE-2025-14550

  Potential denial-of-service vulnerability via repeated headers when using ASGI

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `ASGIRequest` allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series (suc…

  djangoproject Django asgiref python-django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• High 7.5
  CVE-2025-61726

  Memory exhaustion in query parameter parsing in net/url

  The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

  Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 28, 2026
• High 7.5
  CVE-2025-69223

  AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb

  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Versions 3.13.2 and below allow a zip bomb to be used to execute a DoS against the AIOHTTP server. An attacker may be able to send a compressed request that when decompressed by A…

  aio-libs aiohttp open-webui airflow-3 Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 5, 2026
• High 7.5
  CVE-2026-1285

  Potential denial-of-service vulnerability in django.utils.text.Truncator HTML methods

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `django.utils.text.Truncator.chars()` and `Truncator.words()` methods (with `html=True`) and the `truncatechars_html` and `truncatewords_html` template filters allow a remo…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• High 7.5
  CVE-2026-23490

  pyasn1 has a DoS vulnerability in decoder

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.2, a Denial-of-Service issue has been found that leads to memory exhaustion from malformed RELATIVE-OID with excessive continuation octets. This vulnerability is fixed in 0.6.2.

  pyasn1 pyasn1 open-webui katib-earlystopping Debian Ubuntu Wolfi PyPI
  Jan 16, 2026
• High 7.1
  CVE-2026-24049 Public exploit

  wheel Allows Arbitrary File Permission Modification via Path Traversal

  wheel is a command line tool for manipulating Python wheel files, as defined in PEP 427. In versions 0.40.0 through 0.46.1, the unpack function is vulnerable to file permission modification through mishandling of file permissions after extraction. The logic b…

  pypa wheel open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  Jan 22, 2026
• Medium 5.4
  CVE-2026-1207 Public exploit Scanner template EPSS 13%

  Potential SQL injection via raster lookups on PostGIS

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. Raster lookups on ``RasterField`` (only implemented on PostGIS) allows remote attackers to inject SQL via the band index parameter. Earlier, unsupported Django series (such…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• Medium 5.4
  CVE-2026-1287

  Potential SQL injection in column aliases via control characters

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `FilteredRelation` is subject to SQL injection in column aliases via control characters, using a suitably crafted dictionary, with dictionary expansion, as the `**kwargs` p…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Feb 3, 2026
• Medium 5.4
  CVE-2026-1312 Public exploit

  Potential SQL injection via QuerySet.order_by and FilteredRelation

  An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. `.QuerySet.order_by()` is subject to SQL injection in column aliases containing periods when the same alias is, using a suitably crafted dictionary, with dictionary expansi…

  djangoproject Django python-django django Debian Ubuntu Alpine PyPI
  Feb 3, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2427456
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2428412
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2430472
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2431959
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2432398
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2434432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436339
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436340
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436341
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2436342
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_3959.json
• report
  https://access.redhat.com/security/cve/CVE-2025-14550
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-14550
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-14550
• article
  https://docs.djangoproject.com/en/dev/releases/security/
• article
  https://groups.google.com/g/django-announce
• article
  https://www.djangoproject.com/weblog/2026/feb/03/security-releases/
• report
  https://access.redhat.com/security/cve/CVE-2025-61726
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-61726
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-61726
• article
  https://go.dev/cl/736712
• article
  https://go.dev/issue/77101
• article
  https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• advisory
  https://pkg.go.dev/vuln/GO-2026-4341
• report
  https://access.redhat.com/security/cve/CVE-2025-69223
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-69223
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-69223
• article
  https://github.com/aio-libs/aiohttp/commit/2b920c39002cee0ec5b402581779bbaaf7c9138a
• article
  https://github.com/aio-libs/aiohttp/security/advisories/GHSA-6mq8-rvhq-8wgg
• report
  https://access.redhat.com/security/cve/CVE-2026-0994
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-0994
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-0994
• article
  https://github.com/protocolbuffers/protobuf/pull/25239
• report
  https://access.redhat.com/security/cve/CVE-2026-1207
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-1207