Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Fixed packages 8

Vulnerabilities 7

• Critical 9.1
  CVE-2025-68121

  Unexpected session resumption in crypto/tls

  During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have failed. This may happen when a user ca…

  Go standard library crypto/tls langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi Go
  Feb 5, 2026
• High 8.6
  CVE-2026-25990

  Pillow has an out-of-bounds write when loading PSD images

  Pillow is a Python imaging library. From 10.3.0 to before 12.1.1, an out-of-bounds write may be triggered when loading a specially crafted PSD image. This vulnerability is fixed in 12.1.1.

  python-pillow Pillow open-webui kubeflow-pipelines-visualization-server Debian Ubuntu Alpine Wolfi PyPI
  Feb 11, 2026
• High 7.5
  CVE-2025-61726

  Memory exhaustion in query parameter parsing in net/url

  The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encode…

  Go standard library net/url katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Azure Linux Alpine Wolfi Go
  Jan 28, 2026
• High 7.5
  CVE-2026-25639

  Axios affected by Denial of Service via __proto__ Key in mergeConfig

  Axios is a promise based HTTP client for the browser and Node.js. Prior to versions 0.30.3 and 1.13.5, the mergeConfig function in axios crashes with a TypeError when processing configuration objects containing __proto__ as an own property. An attacker can tr…

  axios axios langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Feb 9, 2026
• High 7.5
  CVE-2026-27904

  minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

  minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g.…

  isaacs minimatch katib-suggestion-hyperopt katib-earlystopping Debian Ubuntu Wolfi npm
  Feb 26, 2026
• High 7.5
  CVE-2026-29074

  SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

  SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files. From version 2.1.0 to before version 2.8.1, from version 3.0.0 to before version 3.3.3, and before version 4.0.1, SVGO accepts XML with custom entities,…

  svg svgo vitess-23 svgo Debian Wolfi npm
  Mar 6, 2026
• Low 2.9
  CVE-2025-69873

  ajv has ReDoS when using `$data` option

  ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled. The pattern keyword accepts runtime data via JSON Pointer syntax ($data reference), which is passed directly to t…

  ajv.js ajv langfuse-3-worker katib-suggestion-hyperopt Debian Ubuntu Wolfi npm
  Feb 11, 2026

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6/html/release_notes/patch_releases
• article
  https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2434432
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2437111
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2438237
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439070
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2439170
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2442922
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2445132
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_6277.json
• report
  https://access.redhat.com/security/cve/CVE-2025-61726
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-61726
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-61726
• article
  https://go.dev/cl/736712
• article
  https://go.dev/issue/77101
• article
  https://groups.google.com/g/golang-announce/c/Vd2tYVM8eUc
• advisory
  https://pkg.go.dev/vuln/GO-2026-4341
• report
  https://access.redhat.com/security/cve/CVE-2025-68121
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-68121
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-68121
• article
  https://go.dev/cl/737700
• article
  https://go.dev/issue/77217
• article
  https://groups.google.com/g/golang-announce/c/K09ubi9FQFk
• advisory
  https://pkg.go.dev/vuln/GO-2026-4337
• report
  https://access.redhat.com/security/cve/CVE-2025-69873
• advisory
  https://www.cve.org/CVERecord?id=CVE-2025-69873
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2025-69873
• article
  https://github.com/EthanKim88/ethan-cve-disclosures/blob/main/CVE-2025-69873-ajv-ReDoS.md
• report
  https://access.redhat.com/security/cve/CVE-2026-25639
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25639
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25639
• article
  https://github.com/axios/axios/commit/28c721588c7a77e7503d0a434e016f852c597b57
• article
  https://github.com/axios/axios/releases/tag/v1.13.5
• article
  https://github.com/axios/axios/security/advisories/GHSA-43fc-jf86-j433
• report
  https://access.redhat.com/security/cve/CVE-2026-25990
• advisory
  https://www.cve.org/CVERecord?id=CVE-2026-25990
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2026-25990
• article
  https://github.com/python-pillow/Pillow/commit/9000313cc5d4a31bdcdd6d7f0781101abab553aa