Red Hat Ansible Automation Platform 2.6 for RHEL 10 vulnerabilities

7 known vulnerabilities in Red Hat Ansible Automation Platform 2.6 for RHEL 10 from Red Hat. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Red Hat Ansible Automation Platform 2.5 for…: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-11332Jun 5, 2026Red Hat

  A flaw was found in ansible-core. The ansible-galaxy role install command processes dependency specifications from a role's meta/requirements.yml file. Due to improper neutralization of argument delimiters, a malicious role author can inject arbitrary git conf

• 7.5 High severity

  crypto/x509: Unchecked Input for Loop Condition

  CVE-2026-27145Jun 2, 2026Go standard library

  (*x509.Certificate).VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name (SAN) entries. This caused strings.Split(host, ".") to execute repeatedly on the same input hostname. With a large DNS SAN list, verification co

• 8.2 High severity

  net/http: Improper Validation of Unsafe Equivalence in Input

  CVE-2026-39821May 22, 2026Go standard libraryEPSS 1.83%

  The ToASCII and ToUnicode functions incorrectly accept Punycode-encoded labels that decode to an ASCII-only label. For example, ToUnicode("xn--example-.com") incorrectly returns the name "example.com" rather than an error. This behavior can lead to privilege e

• 7.2 High severity

  Click: Improper Neutralization of Special Elements used in a Command

  CVE-2026-7246Apr 30, 2026Pallets Click

  This CVE record was assigned not following CNA/CVE rules and is not considered a valid vulnerability by the Pallets Click project. The original CVE record description is preserved below: Pallets Click, versions 8.3.2 and below, contain a command injection vuln

• 7.5 High severity

  crypto/tls: Allocation of Resources Without Limits or Throttling

  CVE-2026-32283Apr 8, 2026Go standard library

  If one side of the TLS connection sends multiple key update messages post-handshake in a single record, the connection can deadlock, causing uncontrolled consumption of resources. This can lead to a denial of service. This only affects TLS 1.3.

• 7.5 High severity

  crypto/x509: Allocation of Resources Without Limits or Throttling

  CVE-2026-32280Apr 8, 2026Go standard library

  During chain building, the amount of work that is done is not correctly limited when a large number of intermediate certificates are passed in VerifyOptions.Intermediates, which can lead to a denial of service. This affects both direct users of crypto/x509 and

• 7.5 High severity

  net/url: Allocation of Resources Without Limits or Throttling

  CVE-2025-61726Jan 28, 2026Go standard libraryEPSS 2.29%

  The net/url package does not set a limit on the number of query parameters in a query. While the maximum size of query parameters in URLs is generally limited by the maximum request header size, the net/http.Request.ParseForm method can parse large URL-encoded