RHSA-2026:3959HighCVSS 8.5

Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update

Published
March 6, 2026
Last Modified
July 27, 2026

🔗 CVE IDs covered (11)

CVE-2026-1285 →CVE-2026-1287 →CVE-2026-1312 →CVE-2026-22029 →CVE-2026-23490 →CVE-2025-69223 →CVE-2026-0994 →CVE-2026-1207 →CVE-2026-24049 →CVE-2025-14550 →CVE-2025-61726 →

📋 Description

CVE-2025-14550 — Django: Django: Denial of Service via crafted request with duplicate headers CVE-2025-61726 — golang: net/url: Memory exhaustion in query parameter parsing in net/url CVE-2025-69223 — aiohttp: AIOHTTP's HTTP Parser auto_decompress feature is vulnerable to zip bomb CVE-2026-0994 — python: protobuf: Protobuf: Denial of Service due to recursion depth bypass CVE-2026-1207 — Django: Django: SQL Injection via RasterField band index parameter CVE-2026-1285 — Django: Django: Denial of Service via crafted HTML inputs CVE-2026-1287 — Django: Django: SQL Injection via crafted column aliases CVE-2026-1312 — Django: Django: SQL injection via crafted column aliases in QuerySet.order_by() CVE-2026-22029 — @remix-run/router: react-router: React Router vulnerable to XSS via Open Redirects CVE-2026-23490 — pyasn1: pyasn1: Denial of Service due to memory exhaustion from malformed RELATIVE-OID CVE-2026-24049 — wheel: wheel: Privilege Escalation or Arbitrary Code Execution via malicious wheel file unpacking

🎯 Affected products200

  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.6.0-2.1.el8ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.6.0-2.1.el8ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.6.0-2.1.el8ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.6.0-2.1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.6.0-2.1.el8ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • aap-metrics-utility-0:0.6.0-2.1.el9ap.aarch64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.6.0-2.1.el9ap.ppc64le as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.6.0-2.1.el9ap.s390x as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.6.0-2.1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • aap-metrics-utility-0:0.6.0-2.1.el9ap.x86_64 as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-automation-platform-installer-0:2.5-21.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-automation-platform-installer-0:2.5-21.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-automation-platform-installer-0:2.5-21.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-automation-platform-installer-0:2.5-21.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-builder-0:3.1.1-1.2.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-builder-0:3.1.1-1.2.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-builder-0:3.1.1-1.2.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-builder-0:3.1.1-1.2.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-core-1:2.16.16-1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-core-1:2.16.16-1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-core-1:2.16.16-1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-core-1:2.16.16-1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-creator-0:25.12.0-1.1.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-creator-0:25.12.0-1.1.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-creator-0:25.12.0-1.1.el9ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-creator-0:25.12.0-1.1.el9ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • ansible-dev-environment-0:25.12.2-1.2.el8ap.noarch as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • ansible-dev-environment-0:25.12.2-1.2.el8ap.src as a component of Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • +170 more not shown

✅ Remediation

For details on how to apply this update, refer to Ansible Automation Platform documentation. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible. Workaround: Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Workaround: To mitigate this issue, applications utilizing Django should avoid processing untrusted HTML content through the `django.utils.text.Truncator.chars()` and `Truncator.words()` methods with `html=True`, or the `truncatechars_html` and `truncatewords_html` template filters. Restrict the use of these functions to only trusted inputs where the HTML structure is controlled and validated.

🔗 References (16)