Red Hat Security Advisory

RHSA-2026:6278

Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Released 2026-03-31 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-gateway-proxy-2.5.10-4.el8ap, automation-gateway-proxy-server-2.5.10-4.el8ap, python3.12-pillow-12.1.1-1.el8ap
Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-gateway-proxy-2.6.14-1.el9, automation-gateway-proxy-server-2.6.14-1.el9, python3.12-pillow-12.1.1-1.el9ap

Fixes 3 records

TI-2025-41709 CVE-2025-68121 · GHSA-h355-32pf-p2xm

Unexpected session resumption in crypto/tls

MEDIUM 51

During session resumption in crypto/tls, if the underlying Config has its ClientCAs or RootCAs fields mutated between the initial handshake and the resumed handshake, the resumed handshake may succeed when it should have…

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00902 Published 2026-02-05 Partial fix · 1.24.13, 1.25.7 +1 CWE-295

TI-2026-21005 CVE-2026-25990 · GHSA-cfh3-3jmp-rvhc

Pillow has an out-of-bounds write when loading PSD images

MEDIUM 45

Pillow is a Python imaging library.

CVSS 4.0HIGH 8.6 Local No auth No interaction EPSS 0.00403 Published 2026-02-11 Partial fix · 12.1.1 CWE-787

TI-2025-38128 CVE-2025-61726 · GHSA-gm9r-q53w-2gh4

Memory exhaustion in query parameter parsing in net/url

MEDIUM 43

The net/url package does not set a limit on the number of query parameters in a query.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02292 Published 2026-01-28 Partial fix · 1.24.12, 1.25.6 CWE-770