CVE-2026-120420

{}

{}

{}

{"acknowledgement": "Red Hat would like to thank Liu Chunyan (\u5218\u6625\u71d5) (Fudan University (\u590d\u65e6\u5927\u5b66)) for reporting this issue.", "bugzilla": {"description": "drools-drl-parser: uncontrolled recursion when parsing deeply nested parenthesised expressions leads to denial of service (StackOverflowError)", "id": "2565142", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2565142"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "status": "draft"}, "cwe": "CWE-674", "details": ["A denial-of-service vulnerability was found in the Drools DRL expression parser (org.drools:drools-drl-parser). The ANTLR4-generated DRL expression grammar parses parenthesised sub-expressions through mutually recursive descent rules with no limit on nesting depth. When a deeply nested parenthesised constraint expression (approximately 300-400 levels) is parsed, the parsing thread exhausts its stack and a java.lang.StackOverflowError is raised and propagates out of the parse call instead of being converted into a DroolsParserException. An actor able to supply a crafted DRL expression to an application that parses untrusted DRL can cause a denial of service."], "name": "CVE-2026-120420", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-25/de-minimal-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-27/de-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "ansible-automation-platform-27/de-supported-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "python3.11-drools-jpy-jar", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Not affected", "package_name": "python3.12-drools-jpy-jar", "product_name": "Red Hat Ansible Automation Platform 2"}], "public_date": "2026-11-02T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-120420\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-120420"], "statement": "Red Hat Ansible Automation Platform ships the affected Drools parser via the drools-jpy bridge used by the Event-Driven Ansible rules engine, but is not affected by this flaw. The Event-Driven Ansible integration compiles rulebook conditions into the Drools executable model and does not invoke the DRL rule-language text parser, so the vulnerable code path is not reachable. In addition, rulebook content is authored by trusted operators rather than derived from untrusted input. Legacy Red Hat products that exposed DRL authoring to end users (Decision Manager, Process Automation Manager) are end-of-life and no longer ship Drools.", "threat_severity": "Moderate"}

{"created": "2026-11-03T01:45:09.750044+00:00", "updated": "2026-11-03T01:45:09.750067+00:00", "vendors": []}