CVE-2026-125063

A flaw was found in the rrule validation of schedules in automation controller. Several non-anchored regular expressions with lazy wildcard prefixes are applied to the user-supplied rrule value; when the expected DTSTART/RRULE tokens are absent, validation time grows quadratically with the length of the value. An authenticated user can submit a large token-free rrule through the REST API, including the schedule preview endpoint, which requires no resource-level permissions; validation runs synchronously in the API web worker, so a single such request occupies a worker for an extended time and repeated requests can exhaust the web worker pool, denying access to the API and web UI while the attack is sustained. The impact is limited to availability.

• CWE-1333

• https://access.redhat.com/security/cve/CVE-2026-125063
• https://bugzilla.redhat.com/show_bug.cgi?id=2569200

Published

Nov 9, 2026

Last Modified

Nov 9, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12502Improper Privilege Management (CWE-269) in `/usr/bin/ltsudo`…8.4
• CVE-2026-12503Improper Link Resolution (CWE-59) in `/usr/bin/larm_starter`…9.2
• CVE-2026-12504Improper Authentication (CWE-287) in the PAM configuration i…8.4
• CVE-2026-125040A flaw was found in the SRT and WebVTT subtitle parser in GS…6.5
• CVE-2026-125041A flaw was found in GStreamer's gst-plugins-good MOV/MP4 dem…5.5
• CVE-2026-12505A flaw was found in the cifs-utils package where the cifs.up…7.8
• CVE-2026-125064FFmpeg through 9.0.2 contains a NULL pointer dereference vul…5.5
• CVE-2026-125065FFmpeg through 9.0.2 contains a NULL pointer dereference vul…5.5
• CVE-2026-125066FFmpeg through 9.0.2 contains a NULL pointer dereference vul…5.5
• CVE-2026-125067FFmpeg through 9.0.2 contains a NULL pointer dereference vul…5.5
• CVE-2026-125068FFmpeg through 9.0.2 contains a NULL pointer dereference vul…5.5
• CVE-2026-125069FFmpeg through 9.0.2 contains a NULL pointer dereference vul…4.7