Skip to content
Fencer Intel
medium 4.3

CVE-2026-125063 json

Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web workers (denial of service)

published 6h ago modified 4h ago also EUVD-2026-120159

cvss
4.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
—
no EPSS score yet
public exploits
0
none known

Summary

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length of the value. An authenticated user can submit a large token-free rrule through the REST API, including the schedule preview endpoint, which requires no resource-level permissions; validation runs synchronously in the API web worker, so a single such request occupies a worker for an extended time and repeated requests can exhaust the web worker pool, denying access to the API and web UI while the attack is sustained. The impact is limited to availability.

Is CVE-2026-125063 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-125063 updated cvss 4.3

automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust API web workers (denial of service)

  • Red Hat Ansible Automation Platform 2 automation-controller 4.7.19-1.el9ap, ansible-automation-platform-26/controller-rhel9, ansible-automation-platform-27/controller-rhel9
    affected: workaround, no fix available “The schedule preview endpoint is available to any authenticated user and cannot be restricted by RBAC, so exposure can only be reduced by limiting API access to trusted users.”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CVSS scores

assigned by version score vector
CNA 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L

Affected products

  • Red Hat Red Hat Ansible Automation Platform 2

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.