Automation-controller: automation-controller: quadratic regex in schedule rrule validation allows an authenticated user to exhaust api web…
- Exploited
- No known exploitation
- Fix
- No fix listed
- Who is exposed
- Not reported
- Last modified
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 22/100 · provisional
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
A logged-in user of Automation Controller (Ansible Automation Platform) can trigger this flaw by sending a specially crafted schedule recurrence rule through the REST API or the schedule preview endpoint, which tie up web workers and can make the API and web UI unavailable. The bug is reached remotely over the network, but the attacker needs low-privilege login first, and the impact is limited to denial of service.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
Read the original description
A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length of the value. An authenticated user can submit a large token-free rrule through the REST API, including the schedule preview endpoint, which requires no resource-level permissions; validation runs synchronously in the API web worker, so a single such request occupies a worker for an extended time and repeated requests can exhaust the web worker pool, denying access to the API and web UI while the attack is sustained. The impact is limited to availability.
cve.now Index
- Exploitation?/40Unknown. No CISA SSVC exploitation rating yet
- Exposure3/25Reachable over the network · Unknown: No advisory context yet
- Reach10/20Shipped in major Linux distributions
- Severity4.3/10CVSS 4.3
- No patch5/5No patch listed yet
What would change the score
- Would score about 77 if added to CISA KEV
- Would score about 72 if CISA's SSVC rates exploitation active
- Would score about 41 if advisories confirm default setups are exposed
Timeline
- CVE published
- First seen by cve.now
- Record last updated
Affected versions
- ansible-automation-platform-26/controller-rhel9
Version range not reported
- ansible-automation-platform-27/controller-rhel9
Version range not reported
- automation-controller
Version range not reported
Evidence 2
- Report
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.