Red Hat Product Errata RHSA-2026:24761 - Security Advisory Issued: 2026-06-09 Updated: 2026-06-09 RHSA-2026:24761 - Security Advisory Overview Updated Packages Synopsis Important: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update Type/Severity Security Advisory: Important Red Hat Lightspeed patch analysis Identify and remediate systems affected by this advisory. View affected systems Topic An update is now available for Red Hat Ansible Automation Platform 2.5 Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. Description Red Hat Ansible Automation Platform provides an enterprise framework for building, deploying and managing IT automation at scale. IT Managers can provide top-down guidelines on how automation is applied to individual teams, while automation developers retain the freedom to write tasks that leverage existing knowledge without the overhead. Ansible Automation Platform makes it possible for users across an organization to share, vet, and manage automation content by means of a simple, powerful, and agentless language. Security Fix(es): automation-controller: Cryptography: Buffer overflow via non-contiguous buffer in API (CVE-2026-39892) automation-controller: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion (CVE-2026-30922) automation-gateway: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization (CVE-2025-62718) automation-gateway: Vite: Information disclosure via WebSocket connection bypasses access control (CVE-2026-39363) automation-gateway: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() (CVE-2026-33891) automation-gateway: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification (CVE-2026-33894) automation-gateway: Forge: Authentication bypass via forged Ed25519 cryptographic signatures (CVE-2026-33895) automation-gateway: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance (CVE-2026-33896) automation-gateway: path-to-regexp: Denial of Service via crafted regular expressions (CVE-2026-4926) automation-gateway: Minimatch: Denial of Service via catastrophic backtracking in glob expressions (CVE-2026-27904) automation-gateway: minimatch: Denial of Service via specially crafted glob patterns (CVE-2026-26996) automation-gateway-proxy: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) automation-gateway-proxy: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) python3.12-click: Arbitrary command execution via command injection in click.edit() (CVE-2026-7246) python3.12-cryptography: Buffer overflow via non-contiguous buffer in API (CVE-2026-39892) python3.12-pillow: Denial of Service via decompression bomb in FITS image processing (CVE-2026-40192) receptor: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages (CVE-2026-32283) receptor: Go: Denial of Service vulnerability in certificate chain building (CVE-2026-32280) receptor: Root.Chmod can follow symlinks out of the root (CVE-2026-32282) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. For details about this release, refer to the release notes listed in the References section. Solution For details on how to apply this update, refer to Ansible Automation Platform documentation. Affected Products Red Hat Ansible Automation Platform 2.5 for RHEL 9 x86_64 Red Hat Ansible Automation Platform 2.5 for RHEL 9 s390x Red Hat Ansible Automation Platform 2.5 for RHEL 9 ppc64le Red Hat Ansible Automation Platform 2.5 for RHEL 9 aarch64 Red Hat Ansible Automation Platform 2.5 for RHEL 8 x86_64 Red Hat Ansible Automation Platform 2.5 for RHEL 8 s390x Red Hat Ansible Automation Platform 2.5 for RHEL 8 ppc64le Red Hat Ansible Automation Platform 2.5 for RHEL 8 aarch64 Red Hat Ansible Inside 1.3 for RHEL 9 x86_64 Red Hat Ansible Inside 1.3 for RHEL 9 s390x Red Hat Ansible Inside 1.3 for RHEL 9 ppc64le Red Hat Ansible Inside 1.3 for RHEL 9 aarch64 Red Hat Ansible Inside 1.3 for RHEL 8 x86_64 Red Hat Ansible Inside 1.3 for RHEL 8 s390x Red Hat Ansible Inside 1.3 for RHEL 8 ppc64le Red Hat Ansible Inside 1.3 for RHEL 8 aarch64 Red Hat Ansible Developer 1.2 for RHEL 9 x86_64 Red Hat Ansible Developer 1.2 for RHEL 9 s390x Red Hat Ansible Developer 1.2 for RHEL 9 ppc64le Red Hat Ansible Developer 1.2 for RHEL 9 aarch64 Red Hat Ansible Developer 1.2 for RHEL 8 x86_64 Red Hat Ansible Developer 1.2 for RHEL 8 s390x Red Hat Ansible Developer 1.2 for RHEL 8 ppc64le Red Hat Ansible Developer 1.2 for RHEL 8 aarch64 Fixes BZ - 2441268 - CVE-2026-26996 minimatch: minimatch: Denial of Service via specially crafted glob patterns BZ - 2442922 - CVE-2026-27904 minimatch: Minimatch: Denial of Service via catastrophic backtracking in glob expressions BZ - 2448553 - CVE-2026-30922 pyasn1: pyasn1 Vulnerable to Denial of Service via Unbounded Recursion BZ - 2451867 - CVE-2026-4926 path-to-regexp: path-to-regexp: Denial of Service via crafted regular expressions BZ - 2452450 - CVE-2026-33891 node-forge: node-forge: Denial of Service via infinite loop in BigInteger.modInverse() BZ - 2452457 - CVE-2026-33895 node-forge: Forge: Authentication bypass via forged Ed25519 cryptographic signatures BZ - 2452458 - CVE-2026-33896 node-forge: Forge (node-forge): Certificate validation bypass allows unauthorized certificate issuance BZ - 2452464 - CVE-2026-33894 node-forge: Forge: Signature Forgery via Weak RSASSA PKCS#1 v1.5 Verification BZ - 2456179 - CVE-2026-39363 Vite: Vite: Information disclosure via WebSocket connection bypasses access control BZ - 2456336 - CVE-2026-32282 golang: internal/syscall/unix: Root.Chmod can follow symlinks out of the root BZ - 2456338 - CVE-2026-32283 crypto/tls: golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update messages BZ - 2456339 - CVE-2026-32280 crypto/x509: crypto/tls: golang: Go: Denial of Service vulnerability in certificate chain building BZ - 2456735 - CVE-2026-39892 cryptography: Cryptography: Buffer overflow via non-contiguous buffer in API BZ - 2456913 - CVE-2025-62718 axios: Axios: Server-Side Request Forgery and proxy bypass due to improper hostname normalization BZ - 2458856 - CVE-2026-40192 Pillow: Pillow: Denial of Service via decompression bomb in FITS image processing BZ - 2464121 - CVE-2026-7246 github.com/pallets/click: Pallets Click: Arbitrary command execution via command injection in click.edit() CVEs CVE-2025-62718 CVE-2026-4926 CVE-2026-7246 CVE-2026-26996 CVE-2026-27904 CVE-2026-30922 CVE-2026-32280 CVE-2026-32282 CVE-2026-32283 CVE-2026-33891 CVE-2026-33894 CVE-2026-33895 CVE-2026-33896 CVE-2026-39363 CVE-2026-39892 CVE-2026-40192 References https://access.redhat.com/security/updates/classification/#important https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5/html/release_notes/patch_releases https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform/2.5#Upgrading Note: More recent versions of these packages may be available. Click a package name for more details. Red Hat Ansible Automation Platform 2.5 for RHEL 9 SRPM ansible-automation-platform-installer-2.5-23.el9ap.src.rpm SHA-256: 8b09f9a7364417fa7810e76cfcbfced48b5d7de7483ca69d2a15045ae62e509b automation-controller-4.6.29-2.el9ap.src.rpm SHA-256: f49b2f2515f3d88a70de437c51f7ef3fa7ebe12b6da6332c1e682dba94e914d6 automation-gateway-2.5.20260422-3.el9ap.src.rpm SHA-256: f9a75ea13ca8040dd79446ea8e978cc9d5ddb5b1e354f2c54c1c637a34fde710 automation-gateway-proxy-2.6.14-3.el9ap.src.rpm SHA-256: a8e27e9f387b3b4f4b864a4d6815d738a557471e23646991096fdde00addb6ef automation-hub-4.10.15-1.el9ap.src.rpm SHA-256: c196c91bb35f0aa07e50c19ff82c6c13e3fdb4a73c5c9bd861213cbbca25b11d python3.12-click-8.3.3-1.el9ap.src.rpm SHA-256: 0ed457525b01edc5cbac3adaab8f562747df895d7dc9f8c09e8ebce83ef85e78 python3.12-cryptography-46.0.7-1.el9ap.src.rpm SHA-256: 7ea70ebc36b4e082a74407e4fd222f77521bb448f43e21b2680b4eb389d1893f python3.12-galaxy-ng-4.10.15-1.el9ap.src.rpm SHA-256: 69b8f1dbb84b819d46456e32c326b565759f8d9ca400a4758ff7006b4135abb6 python3.12-pillow-12.2.0-1.el9ap.src.rpm SHA-256: 7159ef59dc4d2ecc71c2bddf4f90ca39b2d83926d1f488d38195acf06fa53376 python3.12-pulpcore-3.49.61-1.el9ap.src.rpm SHA-256: eeca456e9006471839e917001205435e9cd18f151322c55c88f7791e11a9ecb3 receptor-1.6.5-1.el9ap.src.rpm SHA-256: 77a2db8ba8d8a7a5805cf50d9e317d7e18ef064ef47531f154bd9135421eb88b x86_64 ansible-automation-platform-installer-2.5-23.el9ap.noarch.rpm SHA-256: d2a2e82f33a192bf516290f6f6ade74e62081e396f55ec4b8ce04610a6d5e436 automation-controller-4.6.29-2.el9ap.x86_64.rpm SHA-256: 5cbef282780ef67581788bc967c6b0b3ed94fbf445e046745141dae86598c59b automation-controller-cli-4.6.29-2.el9ap.noarch.rpm SHA-256: a5cd58adc4681ea9e10b022f63616ad86df50385bda8044bf33d66f1f54fed3a automation-controller-server-4.6.29-2.el9ap.noarch.rpm SHA-256: 52a9c99337e55ac1543274b98218084496075f3354f965a4cd5add6806323d9f automation-controller-ui-4.6.29-2.el9ap.noarch.rpm SHA-256: d77eb0df992d5dbbf3fc975de39c36df0eccaa64530cea0498c2a3bf6e0c1ef6 automation-controller-venv-tower-4.6.29-2.el9ap.x86_64.rpm SHA-256: 73fbb7f4b5a9c98c5ff946abda82a3b05ebdf86c62af3f456450c8cc1956ecc2 automation-gateway-2.5.20260422-3.el9ap.noarch.rpm SHA-256: 29a8e1f281c03c18bb700b6dd139ecb82f35dbfdddd3f3e096d070e94a8700d8 automation-gateway-config-2.5.20260422-3.el9ap.noarch.rpm SHA-256: 477234c91d9fe1cff0c578cdc0ba86bf10f654bdf4e634e8a7e9618ed2e1144c automation-gateway-proxy-2.6.14-3.el9ap.x86_64.rpm SHA-256: f593d19a6876bd69bc94400b7b0f341b4e7d8f75122a25668d31697c595b4dbc automation-gateway-proxy-debugsource-2.6.1