The vulnerability CVE-2025-69223 affects Red Hat Ansible Automation Platform 2.6 via the AIOHTTP Python library (version 3.13.2 and below). It allows an attacker to send a specially crafted compressed request (zip bomb) that, when decompressed by the server, can consume excessive memory resources leading to a denial of service. This is classified under CWE-770 (Allocation of Resources Without Limits or Throttling). Red Hat has issued a security advisory (RHSA-2026:6309) providing an updated container release that fixes this issue. The advisory notes that mitigation without applying the update is not currently feasible under Red Hat's standards. The vulnerability has a CVSS v3 base score of 7.5 (High) as assessed by Red Hat, with an attack vector over the network, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability can cause a denial of service by exhausting the memory of the host running the affected Ansible Automation Platform 2.6. This can disrupt automation workflows and potentially impact availability of IT automation services. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been observed at this time.

Red Hat has released an updated container release for Ansible Automation Platform 2.6 that addresses this vulnerability. Users should apply this update after ensuring all previous relevant errata have been applied. Currently, no alternative mitigations meet Red Hat's criteria for ease of use, applicability, or stability. Therefore, applying the official update is the recommended remediation. Refer to Red Hat's official documentation for upgrade instructions: https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.6#Upgrade