CVE-2026-116584
Description
A flaw was found in seroval. A remote, unauthenticated attacker can trigger a Denial of Service (DoS) by supplying a crafted serialized payload containing a manipulated array length. Because the deserialization routines do not verify that an array node contains a valid list of elements, the application allocates excessive memory and enters extensive processing loops, causing the process to block execution threads or exhaust available system resources.
Statement
This vulnerability is rated as having an Important severity for Red Hat environments because unauthenticated remote network access can be leveraged to exhaust application memory or hang execution threads with negligible attacker effort. In Red Hat products utilizing seroval within web application interfaces, the issue affects endpoints that accept and decode untrusted serialized requests prior to authentication or input validation. The impact is strictly confined to service availability, with no compromise of system confidentiality or data integrity.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to enforce genuine array type validation and length bounds on deserialized node element lists prior to memory allocation or loop processing: upgrade to seroval 1.6.8 (or the fixed Ansible Automation Platform/Automation Orchestrator Ui Rhel/Forgejo builds), which validate node element lists with Array.isArray and throw SerovalMalformedNodeError if validation fails, closing crafted serialized payload with an array-like object containing an arbitrary length property. Until patched, this is a concern on Applications exposing endpoints that decode untrusted seroval serialized data via fromJSON or fromCrossJSON on any platform, so Restrict network exposure of endpoints invoking fromJSON or fromCrossJSON on untrusted input, or require authentication and input filtering prior to deserialization. As a compensating measure, Cap per-process address space and CPU execution time using ulimit or prlimit to contain unbounded memory allocation and thread lockup, Configure service watchdogs and automatic restarts with systemd WatchdogSec and Restart to recover responsive execution when the process exhausts memory or hangs, Restrict deserialization and validate object structures to enforce that array nodes must be true arrays rather than arbitrary objects, Enforce strict type and object graph validation during deserialization to reject non-array nodes declaring arbitrary length properties, and Bound CPU and memory consumption per container or process group using cgroups v2 resource limits to prevent host-wide impact. These controls limit blast radius and contain exploitation, but they do not fix the underlying unvalidated array length deserialization defect — apply the upstream patch to fully remediate.
Highest-impact CME: CME-1311 Input Size and Quantity Bounds Enforcement (high)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.5 | N/A | 7.5 |
| Attack Vector | Network | N/A | Network |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | None | N/A | None |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | None | N/A | None |
| Integrity Impact | None | N/A | None |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
cve.org: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Understanding the Weakness (CWE)
Confidentiality,Integrity
Technical Impact: Read Memory; Modify Memory; Varies by Context
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
