TI-2026-42344 CVE-2026-59197 · GHSA-xj96-63gp-2gmr
Pillow: Heap out-of-bounds write in Pillow `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`
Priority HIGH 75
Pillow is a Python imaging library.
RHSA-2026:50340
Red Hat Ansible Automation Platform 2.7 Container Release Update
Released 2026-08-04 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9 +7
Fixes 18 records
TI-2026-42746 CVE-2026-59939 · GHSA-j5g9-f88f-gfj3
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Priority HIGH 72
httplib2 is a comprehensive HTTP client library for Python.
TI-2026-39958 CVE-2026-55380 · GHSA-phj9-mv4w-65pm
Pillow GdImageFile decompression bomb protection bypass
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-39957 CVE-2026-55379 · GHSA-45hq-cxwh-f6vc
Pillow BdfFontFile`: `Image.new()` called without `_decompression_bomb_check()` — bomb…
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-38994 CVE-2026-54060 · GHSA-5x94-69rx-g8h2
Pillow: `FontFile.compile()`: `Image.new()` called without `_decompression_bomb_check()`
Priority HIGH 72
Pillow is a Python imaging library.
TI-2026-38992 CVE-2026-54058 · GHSA-62p4-gmf7-7g93
Pillow: Out-of-bounds read via attacker-controlled row stride on Pillow's mmap path (McIdas AREA files)
Priority HIGH 69
Pillow is a Python imaging library.
TI-2026-35886 CVE-2026-48526 · GHSA-xgmm-8j9v-c9wx
PyJWT: Public-key JWK accepted as HMAC secret enables forged HS256 tokens when mixed families are allowed
Priority HIGH 68
PyJWT is a JSON Web Token implementation in Python.
TI-2026-36246 CVE-2026-48990 · GHSA-wphv-vfrh-23q5
joserfc: b64=false RFC7797 JWS payloads bypass JWSRegistry payload-size limits during deserialization
Priority MEDIUM 63
joserfc is a Python library that provides an implementation of several JSON Object Signing and Encryption (JOSE) standards.
TI-2026-14929 CVE-2026-18141 · GHSA-9cwv-qxgx-ff4x
Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header
Priority MEDIUM 42
A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA).
TI-2026-11539 CVE-2026-13676 · GHSA-4c8g-83qw-93j6
fast-uri vulnerable to host confusion via failed IDN canonicalization
Priority MEDIUM 40
fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fail to canonicalize Unicode (IDN) hostnames for HTTP-family URLs.
TI-2026-11166 CVE-2026-13149 · GHSA-3jxr-9vmj-r5cp
Uncontrolled resource consumption in juliangruber brace-expansion
Priority MEDIUM 40
brace-expansion through 5.0.6 is vulnerable to denial of service.
TI-2026-42700 CVE-2026-59886 · GHSA-hm4w-wwcw-mr6r
pyasn1: Uncontrolled resource consumption when converting decoded REAL values
Priority LOW 39
pyasn1 is a generic ASN.1 library for Python.
TI-2026-39183 CVE-2026-54283 · GHSA-82w8-qh3p-5jfq
Starlette: request.form() limits silently ignored for application/x-www-form-urlencoded enable DoS
Priority LOW 39
Starlette is a lightweight ASGI framework/toolkit.
TI-2026-32457 CVE-2026-44545 · GHSA-rrc9-mx66-ffcm
Unbounded WebSocket message and frame sizes can cause unauthenticated remote denial of service
Priority LOW 39
daphne before 4.2.2 did not pass maxFramePayloadSize or maxMessagePayloadSize to Autobahn's WebSocketServerFactory.
TI-2026-29554 CVE-2026-40898 · GHSA-vvgj-x9jq-8cj9
quic-go: HTTP/3 QPACK Trailer Expansion Memory Exhaustion
Priority LOW 39
quic-go is an implementation of the QUIC protocol in Go.
TI-2026-10632 CVE-2026-12383 · GHSA-c4xf-fv75-hwxm
Eda-server: externaleventstreamviewset trusts subject header without validation and leaks expected dn
Priority LOW 39
A flaw was found in the Event-Driven Ansible (EDA) server.
TI-2026-09781 CVE-2026-11332 · GHSA-w8p5-mx5w-cpqj
Ansible-core: argument injection in ansible-galaxy role install leads to arbitrary code execution
Priority LOW 35
A flaw was found in ansible-core.
TI-2026-27214 CVE-2026-34993 · GHSA-jg22-mg44-37j8
AIOHTTP Vulnerable to Deserialization of Untrusted Data
Priority LOW 31
AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python.