Read the docs
Red Hat Security Advisory

RHSA-2026:79378

Red Hat Ansible Automation Platform 2.7 Container Release Update

Released 2026-10-08 · Red Hat rating Critical · View on Red Hat →

Fixed in

Fixes 13 records

TI-2026-62120 CVE-2026-91990 · GHSA-wwvv-qf38-wpf3

Tornado before 6.5.8 Memory Amplification DoS via multipart

Priority HIGH 77

Tornado before 6.5.8 contains a memory amplification vulnerability in parse_multipart_form_data that splits multipart data before validating the max_parts limit.

CVSS 4.0HIGH 8.7 Network No auth No interaction EPSS 0.00424 Published 2026-09-15 Partial fix · 6.5.8 CWE-770
TI-2026-53327 CVE-2026-76222 · GHSA-hmq2-w58f-27jc

GitPython before 3.1.58 Path Traversal via .gitmodules Submodule Name

Priority HIGH 70

GitPython before 3.1.58 fails to validate submodule names from .gitmodules files, allowing attackers to create Git repositories at arbitrary filesystem paths outside the intended clone directory.

CVSS 4.0HIGH 8.4 Network No auth User interaction EPSS 0.00422 Published 2026-08-19 Partial fix · 3.1.58 CWE-22
TI-2026-54688 CVE-2026-78676 · GHSA-284h-m62q-gf8w

GitPython before 3.1.59 Remote Code Execution via Config Injection

Priority MEDIUM 49

GitPython before 3.1.59 fails to safely re-serialize multi-line git-config values during write operations, corrupting dormant quoted values into injected directives like core.hooksPath.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00556 Published 2026-08-25 Partial fix · 3.1.59 CWE-88
TI-2026-53326 CVE-2026-76221 · GHSA-78pq-g4m8-fx2c

GitPython before 3.1.58 Config Injection via option-name

Priority MEDIUM 40

GitPython before 3.1.58 contains a config-name injection vulnerability in the option-name validator that allows attackers to forge arbitrary git-config directives by injecting equals signs, hash symbols, and whitespace i…

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00485 Published 2026-08-19 Partial fix · 3.1.58 CWE-74
TI-2026-53325 CVE-2026-76220 · GHSA-wvpp-8hx9-p66j

GitPython before 3.1.58 Command Execution via split_single_char_options

Priority MEDIUM 40

GitPython before 3.1.58 contains a command execution vulnerability in the check_unsafe_options guard that can be bypassed by combining a single-character kwarg with split_single_char_options=False.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.0059 Published 2026-08-19 Partial fix · 3.1.58 CWE-88
TI-2026-53323 CVE-2026-76218 · GHSA-9rj7-rf2p-w77r

GitPython before 3.1.58 Remote Code Execution via Repo.init

Priority LOW 37

GitPython before 3.1.58 contains a remote code execution vulnerability in Repo.init that forwards unsafe git options without validation.

CVSS 4.0HIGH 7.7 Network Low privileges No interaction EPSS 0.0072 Published 2026-08-19 Partial fix · 3.1.58 CWE-88
TI-2026-33552 CVE-2026-45820 · GHSA-px8p-9vwx-vf98

Uncontrolled resource consumption in 101arrowz fflate

Priority LOW 35

fflate through 0.8.2 is vulnerable to denial of service via an infinite loop in unzipSync().

CVSS 4.0MEDIUM 6.6 Network No auth No interaction EPSS 0.00279 Published 2026-07-22 Partial fix · 0.4.9, 0.5.4 +3 CWE-400
TI-2026-53324 CVE-2026-76219 · GHSA-4gmw-gg2m-w46p

GitPython before 3.1.58 Arbitrary File Overwrite via read-tree

Priority LOW 34

GitPython versions before 3.1.58 contain an arbitrary file overwrite vulnerability in IndexFile.from_tree, IndexFile.reset, and IndexFile.merge_tree methods that append caller-influenced treeish strings to git read-tree…

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00543 Published 2026-08-19 Partial fix · 3.1.58 CWE-88