Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Red Hat Ansible Automation Platform 2. 6 has multiple security vulnerabilities including issues in automation-controller, python3. 11-django, python3. 11-protobuf, python3. 11-urllib3, and receptor components. These vulnerabilities include HTTP request/response smuggling, zip bomb decompression, algorithmic complexity leading to denial of service, improper handling of highly compressed data, unbounded recursion, and excessive resource consumption. Red Hat has released an important security update addressing these issues along with various bug fixes and improvements across the platform components.
AI Analysis
Technical Summary
This advisory covers several security vulnerabilities in Red Hat Ansible Automation Platform 2.6, notably CVE-2025-4565 (unbounded recursion in python3.11-protobuf), CVE-2025-53643 (AIOHTTP HTTP request/response smuggling), CVE-2025-61729 (excessive resource consumption in receptor), CVE-2025-64460 (algorithmic complexity in Django XML deserializer causing denial of service), CVE-2025-66471 (urllib3 streaming API mishandling highly compressed data), and CVE-2025-69223 (AIOHTTP zip bomb vulnerability). The update includes patches for these vulnerabilities and additional bug fixes and feature improvements across the automation-controller, UI, hub, event-driven Ansible, and container-based platform components.
Potential Impact
The vulnerabilities could lead to denial of service conditions, resource exhaustion, and potential manipulation of HTTP request/response handling within the affected components of the Ansible Automation Platform. These issues affect core components such as automation-controller, Django framework, protobuf handling, urllib3 streaming, and receptor certificate validation. Exploitation could disrupt automation workflows and platform stability.
Mitigation Recommendations
Red Hat has released an official security update (RHSA-2026:1249) that addresses all listed vulnerabilities. Users of Red Hat Ansible Automation Platform 2.6 should apply the provided update promptly. The advisory includes updated packages for automation-controller, python3.11-django, python3.11-protobuf, python3.11-urllib3, receptor, and other platform components. Follow the official Red Hat Ansible Automation Platform documentation for applying these updates. No additional mitigation steps are indicated beyond applying the official patches.
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
Description
Red Hat Ansible Automation Platform 2. 6 has multiple security vulnerabilities including issues in automation-controller, python3. 11-django, python3. 11-protobuf, python3. 11-urllib3, and receptor components. These vulnerabilities include HTTP request/response smuggling, zip bomb decompression, algorithmic complexity leading to denial of service, improper handling of highly compressed data, unbounded recursion, and excessive resource consumption. Red Hat has released an important security update addressing these issues along with various bug fixes and improvements across the platform components.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This advisory covers several security vulnerabilities in Red Hat Ansible Automation Platform 2.6, notably CVE-2025-4565 (unbounded recursion in python3.11-protobuf), CVE-2025-53643 (AIOHTTP HTTP request/response smuggling), CVE-2025-61729 (excessive resource consumption in receptor), CVE-2025-64460 (algorithmic complexity in Django XML deserializer causing denial of service), CVE-2025-66471 (urllib3 streaming API mishandling highly compressed data), and CVE-2025-69223 (AIOHTTP zip bomb vulnerability). The update includes patches for these vulnerabilities and additional bug fixes and feature improvements across the automation-controller, UI, hub, event-driven Ansible, and container-based platform components.
Potential Impact
The vulnerabilities could lead to denial of service conditions, resource exhaustion, and potential manipulation of HTTP request/response handling within the affected components of the Ansible Automation Platform. These issues affect core components such as automation-controller, Django framework, protobuf handling, urllib3 streaming, and receptor certificate validation. Exploitation could disrupt automation workflows and platform stability.
Mitigation Recommendations
Red Hat has released an official security update (RHSA-2026:1249) that addresses all listed vulnerabilities. Users of Red Hat Ansible Automation Platform 2.6 should apply the provided update promptly. The advisory includes updated packages for automation-controller, python3.11-django, python3.11-protobuf, python3.11-urllib3, receptor, and other platform components. Follow the official Red Hat Ansible Automation Platform documentation for applying these updates. No additional mitigation steps are indicated beyond applying the official patches.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2026:1249
- Cve Count
- 6
- Additional Cves
- ["CVE-2025-53643","CVE-2025-61729","CVE-2025-64460","CVE-2025-66471","CVE-2025-69223"]
- Cvss Version
- null
Threat ID: 6a16096ae29bf47b5062f627
Added to database: 5/26/2026, 8:58:18 PM
Last enriched: 5/27/2026, 1:34:51 AM
Last updated: 5/27/2026, 4:55:40 AM
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.