Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Fixed packages 44

Vulnerabilities 17

• High 8.2
  CVE-2026-59197

  Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

  Pillow is a Python imaging library. Prior to 12.3.0, Pillow's public rank-filter API can trigger a native heap out-of-bounds write when given a very large odd filter size because ImageFilter.RankFilter.filter() calls image.expand(size // 2, size // 2) before …

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 14, 2026
• High 7.5
  CVE-2026-12383

  Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn

  A flaw was found in the Event-Driven Ansible (EDA) server. The ExternalEventStreamViewSet uses permissive access controls (permission_classes=[AllowAny], authentication_classes=[]) and relies solely on the Subject HTTP header value for mTLS authentication wit…

  Red Hat Red Hat Ansible Automation Platform 2.5 for RHEL 9 Red Hat Ansible Automation Platform 2.5 for RHEL 8 Red Hat Ansible Automation Platform 2.7
  Jul 27, 2026
• High 7.5
  CVE-2026-33811

  Crash when handling long CNAME response in net

  When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.

  Go standard library net golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-39820

  Quadratic string concatentation in consumeComment in net/mail

  Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42499

  Quadratic string concatenation in consumePhrase in net/mail

  Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

  Go standard library net/mail golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  May 7, 2026
• High 7.5
  CVE-2026-42504

  Quadratic complexity in WordDecoder.DecodeHeader in mime

  Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.

  Go standard library mime golang go Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jun 2, 2026
• High 7.5
  CVE-2026-54059

  Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without `_decompression_bomb_check()` — bomb protection bypass via PCF font loading

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/PcfFontFile.py _load_bitmaps() read glyph dimensions from the PCF METRICS section and passed them directly to Image.frombytes() without calling Image._decompression_bomb_check(), allowing crafted PCF fo…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-54060

  Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/FontFile.py FontFile.compile() assembled per-glyph images into a combined bitmap with Image.new("1", (xsize, ysize)) without calling Image._decompression_bomb_check(), allowing a font to trigger excessi…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-55379

  Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb protection bypass via font loading

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/BdfFontFile.py bdf_char() read the BBX width and height field from a BDF font file and passed attacker-controlled dimensions to Image.new() without calling Image._decompression_bomb_check(), bypassing P…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-55380

  Pillow GdImageFile decompression bomb protection bypass

  Pillow is a Python imaging library. Prior to 12.3.0, PIL/GdImageFile.py GdImageFile._open() read image dimensions from the GD 2.x header and stored them in self._size without calling Image._decompression_bomb_check(), allowing a crafted .gd file to trigger ex…

  python-pillow Pillow open-webui pillow Debian Ubuntu Wolfi PyPI
  Jul 6, 2026
• High 7.5
  CVE-2026-59885

  pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the BER, CER, and DER decoders process OBJECT IDENTIFIER and RELATIVE-OID values in quadratic time relative to the number of arcs, so a small crafted payload containing an OID with many arcs consum…

  pyasn1 pyasn1 kubeflow-pipelines-apiserver airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Jul 14, 2026
• High 7.5
  CVE-2026-59886

  pyasn1: Uncontrolled resource consumption when converting decoded REAL values

  pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.4, the univ.Real type converted its mantissa, base, and exponent value to a Python float using exact big-integer exponentiation. A BER, CER, or DER encoded REAL value only a few bytes long can carry a…

  pyasn1 pyasn1 kubeflow-pipelines-apiserver airflow-3 Debian Ubuntu Azure Linux Wolfi PyPI
  Jul 14, 2026
• High 7.4
  CVE-2026-48526

  PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed

  PyJWT is a JSON Web Token implementation in Python. Prior to 2.13.0, when the verifier is decoding JSON Web Tokens, while supporting both asymmetric and HMAC algorithms, the library does not validate use of JSON Web Keys in HMAC algorithm, allowing attacker t…

  jpadilla pyjwt kserve-storage-controller superset-6.0 Debian Ubuntu Azure Linux Wolfi PyPI
  May 28, 2026
• Medium 6.5
  CVE-2026-27145 Public exploit

  Inefficient candidate hostname parsing in crypto/x509

  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification c…

  Go standard library crypto/x509 golang stdlib Debian Ubuntu Azure Linux Wolfi Go
  Jun 2, 2026
• Medium 6.4
  CVE-2026-34993

  AIOHTTP Vulnerable to Deserialization of Untrusted Data

  AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to version 3.14.0, using ``CookieJar.load()`` with untrusted input may allow arbitrary code execution. Most applications using this function will be doing so with the user's…

  aio-libs aiohttp open-webui katib-earlystopping Debian Ubuntu Azure Linux Wolfi PyPI
  Jun 2, 2026
• Medium 5.3
  CVE-2026-40898

  quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion

  quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large traile…

  quic-go quic-go k3s k3s-static Debian Ubuntu Wolfi Go
  Jun 4, 2026
• Medium 5.3
  CVE-2026-44545

  Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service

  daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory. Because Autobahn defaults both values to 0 (unlimited), an unauthenticated remote attacker could send arbitrarily large WebSocket messages or f…

  djangoproject daphne daphne py3-daphne Debian Ubuntu Alpine PyPI
  Jun 3, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2467822
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2482734
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484099
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484207
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484377
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2484875
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2489127
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497452
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497455
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497464
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2497466
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500043
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2500380
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50319.json
• report
  https://access.redhat.com/security/cve/CVE-2026-12383
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-12383
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-12383
• report
  https://access.redhat.com/security/cve/CVE-2026-27145
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-27145
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-27145
• article
  https://go.dev/cl/783621
• article
  https://go.dev/issue/79694
• article
  https://groups.google.com/g/golang-announce/c/tKs3rmcBcKw
• advisory
  https://pkg.go.dev/vuln/GO-2026-5037
• report
  https://access.redhat.com/security/cve/CVE-2026-33811
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-33811
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-33811
• article
  https://go.dev/cl/767860
• article
  https://go.dev/issue/78803
• article
  https://groups.google.com/g/golang-announce/c/qcCIEXso47M
• advisory
  https://pkg.go.dev/vuln/GO-2026-4981
• report
  https://access.redhat.com/security/cve/CVE-2026-34993
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-34993
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-34993
• article
  https://github.com/aio-libs/aiohttp/commit/dcf40f30637e8752c76781cf6703b5a236749a00