Red Hat Ansible Automation Platform 2.6 container releases include a vulnerability tracked as CVE-2025-9909, stemming from an assertion failure in the quic-go Golang library. A malicious server can cause a denial of service by triggering this assertion during the handshake phase, crashing the client process without requiring authentication. The vulnerability is classified under CWE-617 (Reachable Assertion) and CWE-647. Red Hat's advisory states that no fix or suitable mitigation currently exists that meets their standards for ease of deployment and stability. The issue affects versions >=2.6.0 <2.7.0 of the platform. Red Hat recommends applying all previously released errata and monitoring their advisory for updates. No active exploitation has been observed.

The vulnerability allows a remote attacker controlling a server to cause a denial of service on clients using the affected quic-go library within Red Hat Ansible Automation Platform 2.6 containers. This results in a process crash during the handshake phase, leading to availability degradation of the affected automation platform components. There is no impact on confidentiality or integrity. Host Red Hat systems themselves are not at risk of availability degradation from this issue. No known exploits are currently reported in the wild.

Red Hat currently does not provide a fix or effective mitigation for this vulnerability that meets their criteria for ease of use, deployment, or stability. Users should ensure all previously released errata relevant to their system are applied before applying any updates. Monitoring Red Hat advisories for future patches or mitigations is recommended. No immediate action is required beyond applying available updates and errata. Customers with Red Hat Technical Account Managers can consult them for further guidance.