CVE-2026-80179: Allocation of Resources Without Limits or Throttling in Red Hat Red Hat Ansible Automation Platform 2

This vulnerability involves improper resource allocation in the jwcrypto library's handling of JSON Web Encryption tokens. An attacker can craft a malformed JWE token containing many period delimiters, causing the JWE.deserialize() function to allocate excessive memory. This results in a MemoryError and denial of service for services processing untrusted JWE values. The issue affects Red Hat products that use this library, including Red Hat Ansible Automation Platform 2. Red Hat has not released an official fix or effective mitigation at this time.

The vulnerability leads to a denial of service condition by exhausting memory resources when processing maliciously crafted JWE tokens. This can degrade or disrupt availability of affected services. There is no impact on confidentiality or integrity. The attack requires network access but has high attack complexity and no privileges or user interaction are needed.

Currently, no mitigation or fix is available that meets Red Hat's criteria for ease of use, applicability, and stability. Users should monitor Red Hat advisories for updates. Until a fix is released, limiting exposure to untrusted JWE tokens or applying custom filtering may reduce risk but are not officially recommended.