RHSA-2026:50839
Vulnerability from csaf_redhat - Published: 2026-08-05 15:18 - Updated: 2026-08-05 18:46Summary
Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update
Severity
Important
Notes
Topic: Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.
Details: Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub
user experience that simplifies the automation experience for Ansible users of all skill levels.
The Ansible plug-ins provide curated content and features to accelerate Ansible learner
onboarding and streamline Ansible use case adoption across your organization.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed HTTP/2 stream to a gRPC server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library's parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64 | — |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
21 references
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated images are now available for Red Hat Ansible Automation Platform 2.2, which include new features, bug fixes, and enhancements for Red Hat Ansible Automation Platform integration with Red Hat Developer Hub.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Ansible Automation Platform 2.2 delivers an Ansible-first Red Hat Developer Hub\nuser experience that simplifies the automation experience for Ansible users of all skill levels.\nThe Ansible plug-ins provide curated content and features to accelerate Ansible learner\nonboarding and streamline Ansible use case adoption across your organization.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:50839",
"url": "https://access.redhat.com/errata/RHSA-2026:50839"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-48068",
"url": "https://access.redhat.com/security/cve/CVE-2026-48068"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-59877",
"url": "https://access.redhat.com/security/cve/CVE-2026-59877"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform",
"url": "https://docs.redhat.com/en/documentation/red_hat_ansible_automation_platform"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_50839.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Ansible Automation Platform 2.2 security update",
"tracking": {
"current_release_date": "2026-08-05T18:46:43+00:00",
"generator": {
"date": "2026-08-05T18:46:43+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.12"
}
},
"id": "RHSA-2026:50839",
"initial_release_date": "2026-08-05T15:18:10+00:00",
"revision_history": [
{
"date": "2026-08-05T15:18:10+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-05T15:18:15+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-05T18:46:43+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Ansible Automation Platform 2.2",
"product": {
"name": "Red Hat Ansible Automation Platform 2.2",
"product_id": "Red Hat Ansible Automation Platform 2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:ansible_portal:2.2"
}
}
}
],
"category": "product_family",
"name": "Red Hat Ansible Automation Platform"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64",
"product": {
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64",
"product_id": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64",
"product_identification_helper": {
"purl": "pkg:oci/automation-portal@sha256%3A10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a?arch=amd64\u0026repository_url=registry.redhat.io/ansible-automation-platform/automation-portal\u0026tag=1785857303"
}
}
}
],
"category": "architecture",
"name": "amd64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64 as a component of Red Hat Ansible Automation Platform 2.2",
"product_id": "Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
},
"product_reference": "registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64",
"relates_to_product_reference": "Red Hat Ansible Automation Platform 2.2"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-48068",
"cwe": {
"id": "CWE-248",
"name": "Uncaught Exception"
},
"discovery_date": "2026-06-11T13:27:54+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2499682"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in @grpc/grpc-js, a pure JavaScript gRPC client and server library. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This vulnerability affects all servers created using @grpc/grpc-js, and no workaround is available. An unauthenticated remote attacker can exploit this to cause a denial of service by sending a malformed HTTP/2 stream to a gRPC server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "A flaw was found in @grpc/grpc-js. An invalid incoming HTTP/2 stream initiation can cause a server process to crash. This affects all servers created using @grpc/grpc-js. There is no workaround.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-48068"
},
{
"category": "external",
"summary": "RHBZ#2499682",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2499682"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-48068",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-48068"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48068"
},
{
"category": "external",
"summary": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2",
"url": "https://github.com/grpc/grpc-node/security/advisories/GHSA-5375-pq7m-f5r2"
}
],
"release_date": "2026-06-11T13:27:54+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:18:10+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50839"
},
{
"category": "workaround",
"details": "Upgrade to @grpc/grpc-js 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, or 1.14.4. There is no workaround for this vulnerability.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "grpc-js: @grpc/grpc-js: Server crash via malformed HTTP/2 stream initiation"
},
{
"cve": "CVE-2026-59877",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"discovery_date": "2026-07-08T16:01:54.459482+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2498127"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in protobufjs, a JavaScript (JS) library for compiling protobuf definitions. A remote attacker could exploit this vulnerability by providing a specially crafted .proto schema. This schema, designed to prematurely end an option declaration, can cause the library\u0027s parsing functions to loop indefinitely. This leads to a Denial of Service (DoS), making the affected system unresponsive.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "protobufjs: protobufjs: Denial of Service via crafted .proto schema",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "The `protobufjs` library, used in Red Hat products, is susceptible to a Denial of Service when processing a specially crafted `.proto` schema. A remote attacker can exploit this by providing a malformed schema, causing an infinite loop during parsing and leading to service unavailability. This is considered Important due to the potential for significant disruption to services that handle external protobuf definitions.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-59877"
},
{
"category": "external",
"summary": "RHBZ#2498127",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2498127"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-59877",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-59877"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59877"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217",
"url": "https://github.com/protobufjs/protobuf.js/commit/10fba6d54815ceecca8a06b9a6db490c8f5d2217"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f",
"url": "https://github.com/protobufjs/protobuf.js/commit/fa5c73add738ceb471e74da8cc2f3727c3d0a69f"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/pull/2352",
"url": "https://github.com/protobufjs/protobuf.js/pull/2352"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5",
"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v7.6.5"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6",
"url": "https://github.com/protobufjs/protobuf.js/releases/tag/protobufjs-v8.6.6"
},
{
"category": "external",
"summary": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww",
"url": "https://github.com/protobufjs/protobuf.js/security/advisories/GHSA-j3f2-48v5-ccww"
}
],
"release_date": "2026-07-08T15:28:07.696000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-08-05T15:18:10+00:00",
"details": "For more about Ansible plugins for Red Hat Developer Hub, see References links",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:50839"
},
{
"category": "workaround",
"details": "Applications that only encode or decode protobuf messages using trusted schemas are not directly affected. Until patched protobufjs packages (7.6.5 / 8.6.6) are available, do not parse .proto schema text from untrusted sources via parse, Root.load, or Root.loadSync. Where untrusted schema input cannot be avoided, isolate .proto parsing in a dedicated worker thread or subprocess and enforce an explicit timeout so a non-returning parse cannot block the main event loop. Optional process-manager controls (for example systemd restart-on-failure, or CPU/cgroup limits) may reduce host-level impact or aid recovery for supervised services, but they do not fix the parser bug and are not a substitute for input isolation or applying the update.",
"product_ids": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat Ansible Automation Platform 2.2:registry.redhat.io/ansible-automation-platform/automation-portal@sha256:10b6ee6ddb9ab16e5eb98b70336e561a933f5f1490f94427fd888372221d625a_amd64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "protobufjs: protobufjs: Denial of Service via crafted .proto schema"
}
]
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
Loading…
Loading…