CVE-2026-125063
Awaiting Analysis Awaiting Analysis - Queue

Automation Controller RRULE Regex Denial of Service

Publication date: 2026-11-09

Last updated on: 2026-11-09

Assigner: redhat-SADP

Description
A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length of the value. An authenticated user can submit a large token-free rrule through the REST API, including the schedule preview endpoint, which requires no resource-level permissions; validation runs synchronously in the API web worker, so a single such request occupies a worker for an extended time and repeated requests can exhaust the web worker pool, denying access to the API and web UI while the attack is sustained. The impact is limited to availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-09
Last Modified
2026-11-09
Generated
2026-11-09
AI Q&A
2026-11-09
EPSS Evaluated
N/A
NVD
CVE-2026-125063
EUVD
EUVD-2026-120159

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
redhat automation_controller *
red_hat automation_controller *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1333 The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a denial-of-service vulnerability in Red Hat's automation controller. It occurs when an authenticated user submits a large, maliciously crafted rrule value through the REST API. The issue stems from inefficient regular expressions used in rrule validation, which can lead to quadratic time complexity and excessive CPU consumption during processing.

Detection Guidance

Detection involves monitoring for unusually high CPU usage or slow responses from the automation controller API. Check logs for repeated requests to the schedule preview endpoint or REST API with large rrule values. No specific commands are provided in the resources.

Impact Analysis

An attacker can exhaust the web worker pool by sending repeated malicious requests, making the API and web UI inaccessible while the attack persists. The impact is limited to availability; no confidentiality or integrity risks are involved. Service resumes once the malicious requests stop.

Mitigation Strategies

Restrict API access to trusted users only. Apply patches or updates to improve regular expressions and limit rrule length. Monitor for ongoing attacks and block malicious IPs if detected.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-125063. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...