{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for the Red Hat Ansible Automation Portal bootable container image.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Ansible Automation Platform 2.2 delivers the Ansible Automation Portal\nas a bootable container (bootc) image. The image provides a self-contained automation portal\nwith pre-configured services, dynamic plugins, and support for air-gapped deployments.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:51162",
        "url": "https://access.redhat.com/errata/RHSA-2026:51162"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-13149",
        "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-44902",
        "url": "https://access.redhat.com/security/cve/CVE-2026-44902"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-45740",
        "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48068",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48068"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-48801",
        "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59873",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/cve/CVE-2026-59877",
        "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/",
        "url": "https://access.redhat.com/security/updates/classification/"
      },
      {
        "category": "external",
        "summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform",
        "url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_51162.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update",
    "tracking": {
      "current_release_date": "2026-08-08T17:50:06+00:00",
      "generator": {
        "date": "2026-08-08T17:50:06+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.3.12"
        }
      },
      "id": "RHSA-2026:51162",
      "initial_release_date": "2026-08-06T15:37:13+00:00",
      "revision_history": [
        {
          "date": "2026-08-06T15:37:13+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-08-08T04:36:23+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-08-08T17:50:06+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Ansible Automation Platform 2.2",
                "product": {
                  "name": "Red Hat Ansible Automation Platform 2.2",
                  "product_id": "Red Hat Ansible Automation Platform 2.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:ansible_portal:2.2::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Ansible Automation Platform"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64",
                "product": {
                  "name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64",
                  "product_id": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64",
                  "product_identification_helper": {
                    "purl": "pkg:oci/bootc-automation-portal-rhel9@sha256%3A53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9\u0026tag=1786006573"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "amd64"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64 as a component of Red Hat Ansible Automation Platform 2.2",
          "product_id": "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
        },
        "product_reference": "registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64",
        "relates_to_product_reference": "Red Hat Ansible Automation Platform 2.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2026-13149",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-06-30T10:00:59.843854+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2494813"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in brace-expansion. An attacker can exploit a vulnerability in the `expand()` function by providing a specially crafted string. This string, containing consecutive non-expanding brace groups, can trigger exponential-time complexity, leading to significant CPU consumption and event-loop blocking. This can result in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in brace-expansion, a widely-used npm package for expanding brace sequences. The expand() function exhibits exponential-time complexity when processing consecutive non-expanding brace groups. An attacker who can supply crafted input to expand(), directly or transitively via minimatch or glob, can cause significant CPU consumption and event-loop blocking, resulting in denial of service. The max option does not mitigate this issue, as it bounds the output size rather than the recursion work.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "RHBZ#2494813",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2494813"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-13149",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-13149"
        },
        {
          "category": "external",
          "summary": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754",
          "url": "https://github.com/juliangruber/brace-expansion/commit/c7e33ec13ac1a684c116720843ce24e208611754"
        },
        {
          "category": "external",
          "summary": "https://www.npmjs.com/package/brace-expansion",
          "url": "https://www.npmjs.com/package/brace-expansion"
        }
      ],
      "release_date": "2026-06-30T08:30:34.502000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T15:37:13+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51162"
        },
        {
          "category": "workaround",
          "details": "There is no practical mitigation for this vulnerability. The brace-expansion package is typically a transitive dependency pulled in via minimatch and glob, making it difficult to isolate. Users should upgrade to a fixed version of brace-expansion when one becomes available.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "brace-expansion: Brace-expansion: Denial of Service due to exponential-time complexity"
    },
    {
      "cve": "CVE-2026-44902",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-05-27T16:02:06.958159+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2482216"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in opentelemetry-js, specifically within the OpenTelemetry JavaScript (JS) Prometheus exporter. A remote attacker could exploit this vulnerability by sending a single malformed HTTP request to the metrics endpoint. This lack of proper error handling during URL parsing can cause an uncaught TypeError, leading to the termination of any Node.js process running the exporter. This results in a Denial of Service (DoS) for the affected system.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This flaw is rated as Important. A remote attacker can trigger a Denial of Service by sending a malformed HTTP request to the OpenTelemetry JS Prometheus exporter\u0027s metrics endpoint, causing the Node.js process to terminate. This impacts Red Hat products that deploy the affected exporter, leading to service disruption.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-44902"
        },
        {
          "category": "external",
          "summary": "RHBZ#2482216",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482216"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-44902",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-44902"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-44902",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44902"
        },
        {
          "category": "external",
          "summary": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3",
          "url": "https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-q7rr-3cgh-j5r3"
        }
      ],
      "release_date": "2026-05-27T14:49:04.940000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T15:37:13+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51162"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "opentelemetry-js: opentelemetry/exporter-prometheus: opentelemetry-js: Denial of Service via malformed HTTP request"
    },
    {
      "cve": "CVE-2026-45740",
      "cwe": {
        "id": "CWE-776",
        "name": "Improper Restriction of Recursive Entity References in DTDs (\u0027XML Entity Expansion\u0027)"
      },
      "discovery_date": "2026-05-13T16:02:41.729478+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2477081"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs. This vulnerability allows a remote attacker to cause a Denial of Service (DoS) by providing a crafted JSON descriptor with deeply nested namespace definitions. This can lead to the exhaustion of the JavaScript call stack during descriptor loading, making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important denial of service flaw in protobufjs, which could allow a remote attacker to exhaust the JavaScript call stack by providing a specially crafted JSON descriptor with deeply nested namespace definitions. This vulnerability impacts Red Hat products that utilize protobufjs for processing protobuf definitions potentially leading to application unresponsiveness.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "RHBZ#2477081",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477081"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-45740",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45740"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-jggg-4jg4-v7c6"
        }
      ],
      "release_date": "2026-05-13T14:46:02.689000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T15:37:13+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51162"
        },
        {
          "category": "workaround",
          "details": "To mitigate this issue, avoid loading untrusted protobuf JSON descriptors in applications utilizing protobufjs. If untrusted descriptors must be processed, implement validation at an outer boundary to reject excessively nested structures. Alternatively, isolate the descriptor loading process in an environment that can be safely restarted in case of a denial of service.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted JSON descriptors"
    },
    {
      "cve": "CVE-2026-48068",
      "cwe": {
        "id": "CWE-248",
        "name": "Uncaught Exception"
      },
      "discovery_date": "2026-06-11T13:27:54+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2499682"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed HTTP/2 stream to a gRPC server.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "A flaw was found in @grpc/grpc-js. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. There is no workaround.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "RHBZ#2499682",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499682"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48068",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068"
        },
        {
          "category": "external",
          "summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2",
          "url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2"
        }
      ],
      "release_date": "2026-06-11T13:27:54+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T15:37:13+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51162"
        },
        {
          "category": "workaround",
          "details": "Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation"
    },
    {
      "cve": "CVE-2026-48801",
      "cwe": {
        "id": "CWE-1333",
        "name": "Inefficient Regular Expression Complexity"
      },
      "discovery_date": "2026-07-14T21:02:55.149976+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2500656"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in linkify-it, a library for recognizing links with full Unicode support. The LinkifyIt.prototype.match function, the package\u0027s primary public API, has an algorithmic complexity of O(N\u00b2) for inputs containing many fuzzy links or emails. This can be exploited by a remote attacker sending a specially crafted request body, leading to a worker-process denial of service (DoS) due to excessive CPU usage when synchronously rendering untrusted Markdown with linkify enabled.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Moderate impact flaw in linkify-it, a link recognition library, can lead to a denial of service in Red Hat products. The vulnerability arises from an O(N\u00b2) algorithmic complexity when processing untrusted Markdown with numerous fuzzy links or emails, potentially causing excessive CPU consumption and worker-process unavailability. This risk is present in services that synchronously render untrusted Markdown with the linkify feature enabled.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "RHBZ#2500656",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2500656"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-48801",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48801"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159",
          "url": "https://github.com/markdown-it/linkify-it/commit/6be6d15e0641bf1daeaa977d500cabc743166159"
        },
        {
          "category": "external",
          "summary": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4",
          "url": "https://github.com/markdown-it/linkify-it/security/advisories/GHSA-22p9-wv53-3rq4"
        }
      ],
      "release_date": "2026-07-14T20:03:56.430000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T15:37:13+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51162"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "linkify-it: linkify-it: Denial of Service via algorithmic complexity vulnerability"
    },
    {
      "cve": "CVE-2026-59873",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2026-07-08T16:01:31.576716+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498120"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in node-tar, a tar archive manipulation library for Node.js. This vulnerability allows a remote attacker to craft a small gzip bomb, which, when processed, can lead to the exhaustion of disk space and CPU resources. This occurs because node-tar does not enforce strict limits on the total decompressed data, the number of entries, or the decompression ratio during extraction and parsing. The primary impact is a Denial of Service (DoS), making the affected system or application unavailable.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "tar: node-tar: Denial of Service via crafted gzip bomb",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This vulnerability in node-tar is rated as Important. A remote attacker can exploit the lack of strict limits on decompressed data and entry counts within the library\u0027s archive processing to craft a gzip bomb. This can lead to a denial of service by exhausting system resources such as disk space and CPU, making the affected system or application unavailable without requiring authentication.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498120",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498120"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59873",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59873"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3",
          "url": "https://github.com/isaacs/node-tar/commit/2812e9338665659b183aa7226518c307044957d3"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19",
          "url": "https://github.com/isaacs/node-tar/releases/tag/v7.5.19"
        },
        {
          "category": "external",
          "summary": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw",
          "url": "https://github.com/isaacs/node-tar/security/advisories/GHSA-23hp-3jrh-7fpw"
        }
      ],
      "release_date": "2026-07-08T15:22:40.077000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T15:37:13+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51162"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "tar: node-tar: Denial of Service via crafted gzip bomb"
    },
    {
      "cve": "CVE-2026-59877",
      "cwe": {
        "id": "CWE-835",
        "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
      },
      "discovery_date": "2026-07-08T16:01:54.459482+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2498127"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library\u0027s parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "RHBZ#2498127",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498127"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-59877",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217",
          "url": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f",
          "url": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/pull/2352",
          "url": "https://github.com/protobufjs/protobuf.js/pull/2352"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6",
          "url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"
        },
        {
          "category": "external",
          "summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww",
          "url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww"
        }
      ],
      "release_date": "2026-07-08T15:28:07.696000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-08-06T15:37:13+00:00",
          "details": "For more about Ansible Portal Installer Bootc, see References links",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:51162"
        },
        {
          "category": "workaround",
          "details": "Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.",
          "product_ids": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/bootc-automation-portal-rhel9@sha256:53d3067ffe63c784ee1c8b22b4acb0eb50b71814ca4c13e14edfce31b5feabbe_amd64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "protobufjs: protobufjs: Denial of Service via crafted .proto schema"
    }
  ]
}