Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * automation controller: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb (CVE-2025-69223) * automation-controller: Django: algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460) * automation-controller: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643) * python3.11-django: Django: Algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460) * python3.11-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * receptor: Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVE-2025-61729) Updates and fixes included: * ansible-core has been updated to 2.16.15 * ansible-dev-tools has been updated to 26.1.0 * ansible-lint has been updated to 26.1.0 * ansible-navigator has been updated to 26.1.1 * automation-controller has been updated to 4.6.25 * automation-gateway has been updated to 2.5.20260121 * automation-hub has been updated to 4.10.11 * python3.11-botocore has been updated to 1.34.162 * python3.11-django has been updated to 4.2.27 * python3.11-galaxy-importer has been updated to 0.4.37 * python3.11-galaxy-ng has been updated to 4.10.11 * python3.11-requests has been updated to 2.31.0 * python3.11-urllib3 has been updated to 2.6.3 * receptor has been updated to 1.6.3
AI Analysis
Technical Summary
Red Hat Ansible Automation Platform 2.5 contains several security vulnerabilities including CVE-2025-53643, an HTTP Request/Response Smuggling vulnerability in the AIOHTTP HTTP parser's handling of chunked trailer sections within the automation controller. Additional vulnerabilities addressed include improper handling of highly compressed data in urllib3 (CVE-2025-66471), a zip bomb vulnerability in AIOHTTP's auto_decompress feature (CVE-2025-69223), algorithmic complexity in Django's XML deserializer causing denial of service (CVE-2025-64460), and excessive resource consumption in receptor's certificate validation (CVE-2025-61729). Red Hat has released updated packages for ansible-core, automation-controller, and other related components to remediate these issues.
Potential Impact
The vulnerabilities can lead to denial of service conditions through resource exhaustion or algorithmic complexity attacks, and HTTP request/response smuggling which may allow attackers to interfere with HTTP traffic processing. Improper handling of compressed data can also be exploited to cause resource exhaustion. These issues affect the stability and reliability of the automation platform and could potentially disrupt automation workflows or allow manipulation of HTTP communications within the affected components.
Mitigation Recommendations
Red Hat has released official patches addressing these vulnerabilities in updated versions of Red Hat Ansible Automation Platform 2.5 and its components. Users should apply the updates as provided in Red Hat Security Advisory RHSA-2026:1506 to remediate these issues. The advisory lists specific updated package versions including ansible-core 2.16.15, automation-controller 4.6.25, and others. No additional mitigations beyond applying the official updates are indicated by the vendor.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * automation controller: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb (CVE-2025-69223) * automation-controller: Django: algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460) * automation-controller: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643) * python3.11-django: Django: Algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460) * python3.11-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * receptor: Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVE-2025-61729) Updates and fixes included: * ansible-core has been updated to 2.16.15 * ansible-dev-tools has been updated to 26.1.0 * ansible-lint has been updated to 26.1.0 * ansible-navigator has been updated to 26.1.1 * automation-controller has been updated to 4.6.25 * automation-gateway has been updated to 2.5.20260121 * automation-hub has been updated to 4.10.11 * python3.11-botocore has been updated to 1.34.162 * python3.11-django has been updated to 4.2.27 * python3.11-galaxy-importer has been updated to 0.4.37 * python3.11-galaxy-ng has been updated to 4.10.11 * python3.11-requests has been updated to 2.31.0 * python3.11-urllib3 has been updated to 2.6.3 * receptor has been updated to 1.6.3
Affected software
pkg:pypi/python3-11-galaxy-importerRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Ansible Automation Platform 2.5 contains several security vulnerabilities including CVE-2025-53643, an HTTP Request/Response Smuggling vulnerability in the AIOHTTP HTTP parser's handling of chunked trailer sections within the automation controller. Additional vulnerabilities addressed include improper handling of highly compressed data in urllib3 (CVE-2025-66471), a zip bomb vulnerability in AIOHTTP's auto_decompress feature (CVE-2025-69223), algorithmic complexity in Django's XML deserializer causing denial of service (CVE-2025-64460), and excessive resource consumption in receptor's certificate validation (CVE-2025-61729). Red Hat has released updated packages for ansible-core, automation-controller, and other related components to remediate these issues.
Potential Impact
The vulnerabilities can lead to denial of service conditions through resource exhaustion or algorithmic complexity attacks, and HTTP request/response smuggling which may allow attackers to interfere with HTTP traffic processing. Improper handling of compressed data can also be exploited to cause resource exhaustion. These issues affect the stability and reliability of the automation platform and could potentially disrupt automation workflows or allow manipulation of HTTP communications within the affected components.
Mitigation Recommendations
Red Hat has released official patches addressing these vulnerabilities in updated versions of Red Hat Ansible Automation Platform 2.5 and its components. Users should apply the updates as provided in Red Hat Security Advisory RHSA-2026:1506 to remediate these issues. The advisory lists specific updated package versions including ansible-core 2.16.15, automation-controller 4.6.25, and others. No additional mitigations beyond applying the official updates are indicated by the vendor.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:1506
- Cve Count
- 5
- Additional Cves
- ["CVE-2025-61729","CVE-2025-64460","CVE-2025-66471","CVE-2025-69223"]
Threat ID: 6a16096ae29bf47b5062f61b
Added to database: 05/26/2026, 20:58:18 UTC
Last enriched: 08/17/2026, 17:13:14 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 122
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.