TI-2026-42344 CVE-2026-59197 · GHSA-xj96-63gp-2gmr
Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Priority HIGH 75
Pillow is a Python imaging library.
RHSA-2026:50336
Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Released 2026-08-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.7-1.el10ap, receptorctl-1.6.7-1.el10ap
- Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-4.7.15-2.el9ap, automation-controller-cli-4.7.15-2.el9ap, automation-controller-server-4.7.15-2.el9ap +15
Fixes 17 records
TI-2026-39958 CVE-2026-55380 · GHSA-phj9-mv4w-65pm
Pillow GdImageFile decompression bomb protection bypass
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-39957 CVE-2026-55379 · GHSA-45hq-cxwh-f6vc
Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb…
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-38994 CVE-2026-54060 · GHSA-5x94-69rx-g8h2
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-38993 CVE-2026-54059 · GHSA-8v84-f9pq-wr9x
Pillow: PcfFontFile._load_bitmaps()`: `Image.frombytes()` called without…
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-35886 CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Priority HIGH 68
PyJWT is a JSON Web Token implementation in Python.
TI-2026-14929 CVE-2026-18141 · GHSA-9cwv-qxgx-ff4x
Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
Priority MEDIUM 42
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA).
TI-2026-42699 CVE-2026-59885 · GHSA-8ppf-4f7h-5ppj
pyasn1: Quadratic complexity in OBJECT IDENTIFIER and RELATIVE-OID processing allows denial of service
Priority MEDIUM 40
pyasn1 is a generic ASN.1 library for Python.
TI-2026-30787 CVE-2026-42504 · GHSA-h524-452v-82p9
Quadratic complexity in WordDecoder.DecodeHeader in mime
Priority MEDIUM 40
Decoding a maliciously-crafted MIME header containing many invalid encoded-words can consume excessive CPU.
TI-2026-30782 CVE-2026-42499 · GHSA-xq5j-9r39-c3vf
Quadratic string concatenation in consumePhrase in net/mail
Priority MEDIUM 40
Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.
TI-2026-28702 CVE-2026-39820 · GHSA-p9h5-jm8x-mjm5
Quadratic string concatentation in consumeComment in net/mail
Priority MEDIUM 40
Well-crafted inputs reaching ParseAddress, ParseAddressList, and ParseDate were able to trigger excessive CPU exhaustion and memory allocations.
TI-2026-26183 CVE-2026-33811 · GHSA-497x-jcxf-m478
Crash when handling long CNAME response in net
Priority MEDIUM 40
When using LookupCNAME with the cgo DNS resolver, a very long CNAME response can trigger a double-free of C memory and a crash.
TI-2026-42700 CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Priority LOW 39
pyasn1 is a generic ASN.1 library for Python.
TI-2026-32457 CVE-2026-44545 · GHSA-rrc9-mx66-ffcm
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
Priority LOW 39
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory.
TI-2026-29554 CVE-2026-40898 · GHSA-vvgj-x9jq-8cj9
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
Priority LOW 39
quic-go is an implementation of the QUIC protocol in Go.
TI-2026-10632 CVE-2026-12383 · GHSA-c4xf-fv75-hwxm
Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn
Priority LOW 39
A flaw was found in the Event-Driven Ansible (EDA) server.
TI-2026-27214 CVE-2026-34993 · GHSA-jg22-mg44-37j8
AIOHTTP Vulnerable to Deserialization of Untrusted Data
Priority LOW 31
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.