Red Hat Ansible Automation Platform 2.5 contains a potential denial-of-service vulnerability in the ansible-lightspeed-container component related to IPv6 validation, tracked as CVE-2024-56374. This vulnerability could allow an attacker to cause a denial of service. Red Hat has addressed this issue by releasing updated versions of the ansible.controller collection (4.6.7), ansible.eda collection (2.3.1), Automation Controller (4.6.7), Automation EDA Controller (1.1.4), and Ansible Lightspeed (2.5.20250121). The advisory (RHSA-2025:0782) confirms the fix and provides additional configuration improvements. The affected versions include Red Hat Ansible Automation Platform 2.5 for RHEL 8 and RHEL 9 on multiple CPU architectures. No CVSS score is provided, but the severity is rated moderate by Red Hat. No known active exploitation has been reported.

The vulnerability could allow an attacker to cause a denial-of-service condition via malformed IPv6 input to the ansible-lightspeed-container component. This may disrupt automation services managed by Red Hat Ansible Automation Platform 2.5. There are no reports of active exploitation in the wild. The impact is limited to service availability disruption rather than code execution or data compromise.

Red Hat has released official fixes for this vulnerability in updated versions of the Ansible Automation Platform components, including Automation Controller 4.6.7 and Ansible Lightspeed 2.5.20250121. Users should apply these updates promptly to remediate the vulnerability. No additional mitigation steps are indicated by the vendor advisory.