Red Hat Security Advisory

RHSA-2026:6277

Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update

Released 2026-03-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-gateway-proxy-2.6.14-1.el9, automation-gateway-proxy-server-2.6.14-1.el9, automation-platform-ui-2.6.7-1.el9ap +1

Fixes 7 records

TI-2025-42946 CVE-2025-69873 · GHSA-2g4f-4pwh-qvx6

Regular expression denial of service in ajv.js ajv

HIGH 72

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00539 Published 2026-02-11 Partial fix · 6.14.0, 8.17.2 +1 CWE-1333

TI-2026-22248 CVE-2026-27904 · GHSA-23c5-xmqv-rm74

minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions

HIGH 66

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00525 Published 2026-02-26 Partial fix · 10.2.3, 9.0.7 +6 CWE-1333

TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm

Unexpected session resumption in crypto/tls

MEDIUM 51

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00902 Published 2026-02-05 Partial fix · 1.24.13, 1.25.7 +1 CWE-295

TI-2026-21005 CVE-2026-25990 · GHSA-cfh3-3jmp-rvhc

Pillow has an out-of-bounds write when loading PSD images

MEDIUM 45

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00403 Published 2026-02-11 Partial fix · 12.1.1 CWE-787

TI-2026-20739 CVE-2026-25639 · GHSA-43fc-jf86-j433

Axios affected by Denial of Service via proto Key in mergeConfig

MEDIUM 44

Axios is a promise based HTTP client for the browser and Node.js.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02759 Published 2026-02-09 Partial fix · 1.13.5, 0.30.3 CWE-754

TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4

Memory exhaustion in query parameter parsing in net/url

MEDIUM 43

The net/url package does not set a limit on the number of query parameters in a query.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02292 Published 2026-01-28 Partial fix · 1.24.12, 1.25.6 CWE-770

TI-2026-23219 CVE-2026-29074 · GHSA-xpqw-6gx7-v673

SVGO: DoS through entity expansion in DOCTYPE (Billion Laughs)

MEDIUM 40

SVGO, short for SVG Optimizer, is a Node.js library and command-line application for optimizing SVG files.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00702 Published 2026-03-06 Partial fix · 2.8.1, 3.3.3 +1 CWE-776