Red Hat Security Advisory

RHSA-2026:42815

Red Hat Ansible Automation Platform 2.2 security update

Released 2026-07-21 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.2 registry.redhat.io/ansible-automation-platform/automation-portal

Fixes 11 records

TI-2026-42687 CVE-2026-59873 · GHSA-23hp-3jrh-7fpw

node-tar: Decompression/parse DoS via unlimited input

HIGH 79

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00582 Published 2026-07-08 Partial fix · 7.5.19 CWE-770

TI-2026-42688 CVE-2026-59874 · GHSA-8x88-c5mf-7j5w

node-tar: Negative tar entry size causes infinite loop in archive replace

HIGH 77

node-tar is a tar archive manipulation library for Node.js.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00434 Published 2026-07-08 Partial fix · 7.5.18 CWE-835

TI-2026-36071 CVE-2026-48801 · GHSA-22p9-wv53-3rq4

linkify-it: Quadratic algorithmic complexity in LinkifyIt#match scan loop

HIGH 77

linkify-it is a links recognition library with full Unicode support.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00394 Published 2026-07-14 Partial fix · 5.0.1 CWE-1333

TI-2026-36811 CVE-2026-49978 · GHSA-rp9w-3fw7-7cwq

DOMPurify IN_PLACE Sanitization Bypass via Attached Shadow Root Inside <template>.content

MEDIUM 61

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG.

CVSS 4.0MEDIUM 6.3 Network No auth User interaction EPSS 0.00404 Published 2026-07-14 Partial fix · 3.4.6, 3.4.7 CWE-79

TI-2026-32260 CVE-2026-44289 · GHSA-685m-2w69-288q

protobufjs: Denial of service through unbounded protobuf recursion

MEDIUM 40

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.0063 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-674

TI-2026-11539 CVE-2026-13676 · GHSA-4c8g-83qw-93j6

fast-uri vulnerable to host confusion via failed IDN canonicalization

MEDIUM 40

fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00692 Published 2026-06-29 Partial fix · 4.0.1, 3.1.3 +1 CWE-436

TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp

Uncontrolled resource consumption in juliangruber brace-expansion

MEDIUM 40

brace-expansion through 5.0.6 is vulnerable to denial of service.

CVSS 4.0HIGH 7.7 Network No auth No interaction EPSS 0.00364 Published 2026-06-30 Partial fix · 5.0.7, 1.1.16 +1 CWE-400

TI-2026-32261 CVE-2026-44290 · GHSA-jvwf-75h9-cwgg

protobufjs: Process-wide denial of service through unsafe option paths

LOW 39

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00374 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-1321

TI-2026-33477 CVE-2026-45740 · GHSA-jggg-4jg4-v7c6

protobufjs: Denial of Service via unbounded recursive JSON descriptor expansion

LOW 38

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00263 Published 2026-05-13 Partial fix · 7.5.8, 8.2.0 CWE-674

TI-2026-32262 CVE-2026-44291 · GHSA-75px-5xx7-5xc7

protobufjs: Code generation gadget after prototype pollution

LOW 38

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1HIGH 8.1 Network No auth No interaction EPSS 0.005 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-94

TI-2026-32263 CVE-2026-44292 · GHSA-fx83-v9x8-x52w

protobufjs: Prototype injection in generated message constructors

LOW 30

protobufjs compiles protobuf definitions into JavaScript (JS) functions.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00264 Published 2026-05-13 Partial fix · 7.5.6, 8.0.2 CWE-1321