Red Hat Automation Controller rrule ReDoS DoS via REST API
CVE-2026-125063 Published on November 9, 2026
Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web workers (denial of service)
A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length of the value. An authenticated user can submit a large token-free rrule through the REST API, including the schedule preview endpoint, which requires no resource-level permissions; validation runs synchronously in the API web worker, so a single such request occupies a worker for an extended time and repeated requests can exhaust the web worker pool, denying access to the API and web UI while the attack is sustained. The impact is limited to availability.
Vulnerability Analysis
CVE-2026-125063 can be exploited with network access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity, and a small impact on availability.
Timeline
Reported to Red Hat.
Made public. 5 days later.
Weakness Type
What is a ReDoS Vulnerability?
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met:
CVE-2026-125063 has been classified to as a ReDoS vulnerability or weakness.
Products Associated with CVE-2026-125063
Want to know whenever a new CVE is published for Red Hat Ansible Automation Platform? stack.watch will email you.
