Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643) * automation-controller: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb (CVE-2025-69223) * automation-controller: Django: Algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460) * automation-controller: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * python3.11-django: Algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460) * python3.11-protobuf: Unbounded recursion in Python Protobuf (CVE-2025-4565) * python3.11-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * receptor: Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform * Reduced cognitive complexity in _sync_user_superuser_flag (AAP-62771) * The FEATURE_GATEWAY_IPV6_USAGE_ENABLED feature flag has been removed and IPv6 support is enabled by default (AAP-61805) * Fixed an issue preventing gateway from working in a pure IPv4 single stack environment when IPv6 is enabled (AAP-60478) * Added dedicated aap.auth_audit logger with specialized formatters and handlers (AAP-60364) * Introduced new logs for authentication events (AAP-60364) * automation-gateway has been updated to 2.6.20260121 * python3.11-django-ansible-base has been updated to 2.6.20260121 Automation Platform UI * Page titles now reflect the current page content (AAP-61754) * Allow full search in resource dropdowns (AAP-57712) * Fixed an issue that occasionally showed a bad request status when navigating between different pages (AAP-56701) * Fixed filtering by name in Collections page (AAP-56529) * Fixed clear/browse button behavior in Client Certificate and Client Key (AAP-55296) * Fixed an issue where a Rulebook Activation in workers offline status could not be disabled or deleted (AAP-52714) * Fixed an issue where workflow job templates node credentials are missing after save for job template nodes that have a default credential that is promptable (AAP-52638) * Fixed an issue where the gateway UI reset the order of an auth mapping when the entity was edited by the user (AAP-52258) * Improves labels and descriptions for Authenticator Mappings details (AAP-51295) * Resolved an issue where controller unavailability rendered the entire AAP UI inaccessible (AAP-50106) * Fixed descriptions for Remotes and Remote Registries (AAP-49838) * Survey textarea "Default Answer" field now properly accepts newlines when pressing Enter (AAP-49820) * Fixed review page on Workflow Approval Nodes (AAP-49433) * Fixed editing of "Days of data to keep" value in management job schedules (AAP-48972) * Editing and saving credentials that use external credential lookup plugins (such as CyberArk) no longer fails with an error message (AAP-44813) * Fixed an issue where the SAML Service Provider extra configuration data field could not be cleared in the UI, as it would automatically reset to the default value (AAP-43661) * Resolved an issue where ad-hoc commands failed with a "Bad Request" error when using credentials configured with "Prompt on launch" for password fields (AAP-43603) * Updated modal warning message and layout when enabling a copied Rulebook Activation (AAP-42574) * automation-platform-ui has been updated to 2.6.5 Automation controller * Added runtime feature flags (AAP-62686) * automation-controller has been updated to 4.7.8 * receptor has been updated to 1.6.3 Automation hub * Autocomplete attribute added to the Automation Hub API password field (AAP-59910) * automation-hub has been updated to 4.11.5 * python3.11-galaxy-importer has been updated to 0.4.37 * python3.11-galaxy-ng has been updated to 4.11.5 * python3.11-pulpcore has been updated to 3.49.49 Event-Driven Ansible * Added x-ai-description field to the activation PATCH method (AAP-61969) * automation-eda-controller has been updated to 1.2.4 Container-based Ansible Automation Platform * Added lTLS support to lightspeed chatbot service (AAP-60900) * system-prompt was optimized for granite and openai models (AAP-60898) * Added ipv6 support (AAP-60532) * Fixed an issue w
AI Analysis
Technical Summary
This Red Hat Security Advisory (RHSA-2026:1249) addresses several vulnerabilities in Red Hat Ansible Automation Platform 2.6. Key security issues fixed include: CVE-2025-53643 (AIOHTTP HTTP request/response smuggling), CVE-2025-69223 (AIOHTTP HTTP parser zip bomb vulnerability), CVE-2025-64460 (algorithmic complexity in Django XML deserializer causing denial of service), CVE-2025-66471 (urllib3 Streaming API mishandling highly compressed data), CVE-2025-4565 (unbounded recursion in Python Protobuf), and CVE-2025-61729 (excessive resource consumption in receptor during certificate validation). These vulnerabilities impact various components of the platform, potentially leading to denial of service or resource exhaustion. The advisory provides updated package versions and numerous bug fixes. The affected product versions explicitly include Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 10 across multiple CPU architectures.
Potential Impact
The vulnerabilities fixed in this update can lead to denial of service conditions through resource exhaustion or algorithmic complexity attacks, HTTP request/response smuggling, and improper handling of compressed data which could disrupt normal operation of the automation platform. The unbounded recursion in Python Protobuf and excessive resource consumption during certificate validation could also degrade system stability. These issues affect core components responsible for automation task execution and communication, potentially impacting availability and reliability of the platform.
Mitigation Recommendations
An official security update is available from Red Hat addressing these vulnerabilities. Users of Red Hat Ansible Automation Platform 2.6 should apply the provided updates as documented in the Red Hat advisory RHSA-2026:1249. The vendor has released fixed versions of automation-controller, python3.11-django, python3.11-protobuf, python3.11-urllib3, receptor, and related components. Follow Red Hat's official documentation for update procedures to ensure all fixes are applied. No additional mitigation steps are indicated beyond applying the official patches.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): * automation-controller: AIOHTTP HTTP Request/Response Smuggling (CVE-2025-53643) * automation-controller: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb (CVE-2025-69223) * automation-controller: Django: Algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460) * automation-controller: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * python3.11-django: Algorithmic complexity in XML Deserializer leads to denial of service (CVE-2025-64460) * python3.11-protobuf: Unbounded recursion in Python Protobuf (CVE-2025-4565) * python3.11-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * receptor: Excessive resource consumption when printing error string for host certificate validation in crypto/x509 (CVE-2025-61729) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Updates and fixes included: Automation Platform * Reduced cognitive complexity in _sync_user_superuser_flag (AAP-62771) * The FEATURE_GATEWAY_IPV6_USAGE_ENABLED feature flag has been removed and IPv6 support is enabled by default (AAP-61805) * Fixed an issue preventing gateway from working in a pure IPv4 single stack environment when IPv6 is enabled (AAP-60478) * Added dedicated aap.auth_audit logger with specialized formatters and handlers (AAP-60364) * Introduced new logs for authentication events (AAP-60364) * automation-gateway has been updated to 2.6.20260121 * python3.11-django-ansible-base has been updated to 2.6.20260121 Automation Platform UI * Page titles now reflect the current page content (AAP-61754) * Allow full search in resource dropdowns (AAP-57712) * Fixed an issue that occasionally showed a bad request status when navigating between different pages (AAP-56701) * Fixed filtering by name in Collections page (AAP-56529) * Fixed clear/browse button behavior in Client Certificate and Client Key (AAP-55296) * Fixed an issue where a Rulebook Activation in workers offline status could not be disabled or deleted (AAP-52714) * Fixed an issue where workflow job templates node credentials are missing after save for job template nodes that have a default credential that is promptable (AAP-52638) * Fixed an issue where the gateway UI reset the order of an auth mapping when the entity was edited by the user (AAP-52258) * Improves labels and descriptions for Authenticator Mappings details (AAP-51295) * Resolved an issue where controller unavailability rendered the entire AAP UI inaccessible (AAP-50106) * Fixed descriptions for Remotes and Remote Registries (AAP-49838) * Survey textarea "Default Answer" field now properly accepts newlines when pressing Enter (AAP-49820) * Fixed review page on Workflow Approval Nodes (AAP-49433) * Fixed editing of "Days of data to keep" value in management job schedules (AAP-48972) * Editing and saving credentials that use external credential lookup plugins (such as CyberArk) no longer fails with an error message (AAP-44813) * Fixed an issue where the SAML Service Provider extra configuration data field could not be cleared in the UI, as it would automatically reset to the default value (AAP-43661) * Resolved an issue where ad-hoc commands failed with a "Bad Request" error when using credentials configured with "Prompt on launch" for password fields (AAP-43603) * Updated modal warning message and layout when enabling a copied Rulebook Activation (AAP-42574) * automation-platform-ui has been updated to 2.6.5 Automation controller * Added runtime feature flags (AAP-62686) * automation-controller has been updated to 4.7.8 * receptor has been updated to 1.6.3 Automation hub * Autocomplete attribute added to the Automation Hub API password field (AAP-59910) * automation-hub has been updated to 4.11.5 * python3.11-galaxy-importer has been updated to 0.4.37 * python3.11-galaxy-ng has been updated to 4.11.5 * python3.11-pulpcore has been updated to 3.49.49 Event-Driven Ansible * Added x-ai-description field to the activation PATCH method (AAP-61969) * automation-eda-controller has been updated to 1.2.4 Container-based Ansible Automation Platform * Added lTLS support to lightspeed chatbot service (AAP-60900) * system-prompt was optimized for granite and openai models (AAP-60898) * Added ipv6 support (AAP-60532) * Fixed an issue w
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This Red Hat Security Advisory (RHSA-2026:1249) addresses several vulnerabilities in Red Hat Ansible Automation Platform 2.6. Key security issues fixed include: CVE-2025-53643 (AIOHTTP HTTP request/response smuggling), CVE-2025-69223 (AIOHTTP HTTP parser zip bomb vulnerability), CVE-2025-64460 (algorithmic complexity in Django XML deserializer causing denial of service), CVE-2025-66471 (urllib3 Streaming API mishandling highly compressed data), CVE-2025-4565 (unbounded recursion in Python Protobuf), and CVE-2025-61729 (excessive resource consumption in receptor during certificate validation). These vulnerabilities impact various components of the platform, potentially leading to denial of service or resource exhaustion. The advisory provides updated package versions and numerous bug fixes. The affected product versions explicitly include Red Hat Ansible Automation Platform 2.6 for RHEL 9 and 10 across multiple CPU architectures.
Potential Impact
The vulnerabilities fixed in this update can lead to denial of service conditions through resource exhaustion or algorithmic complexity attacks, HTTP request/response smuggling, and improper handling of compressed data which could disrupt normal operation of the automation platform. The unbounded recursion in Python Protobuf and excessive resource consumption during certificate validation could also degrade system stability. These issues affect core components responsible for automation task execution and communication, potentially impacting availability and reliability of the platform.
Mitigation Recommendations
An official security update is available from Red Hat addressing these vulnerabilities. Users of Red Hat Ansible Automation Platform 2.6 should apply the provided updates as documented in the Red Hat advisory RHSA-2026:1249. The vendor has released fixed versions of automation-controller, python3.11-django, python3.11-protobuf, python3.11-urllib3, receptor, and related components. Follow Red Hat's official documentation for update procedures to ensure all fixes are applied. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:1249
- Cve Count
- 6
- Additional Cves
- ["CVE-2025-53643","CVE-2025-61729","CVE-2025-64460","CVE-2025-66471","CVE-2025-69223"]
- State
- PUBLISHED
Threat ID: 6a16096ae29bf47b5062f627
Added to database: 05/26/2026, 20:58:18 UTC
Last enriched: 08/17/2026, 17:13:38 UTC
Last updated: 09/10/2026, 22:05:24 UTC
Views: 189
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.