A quadratic regular‑expression engine was used in the schedule rrule validation of the automation controller. When a user submits a rrule that does not contain the expected DTSTART or RRULE tokens, the validation logic consumes an increasing amount of time that grows with the square of the input length. This leads the API web worker that performs the check to stay occupied for an extended period, allowing an attacker to deplete the pool of workers and temporarily deny access to the API and Web UI. The flaw is limited to availability and does not expose confidential data or compromise integrity.

The vulnerability affects Red Hat Ansible Automation Platform 2, specifically the "automation-controller" component that handles schedule creation and preview. No additional version qualifiers are listed, so all builds of version 2 are potentially impacted.

The CVSS score of 4.3 indicates a moderate risk; the EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. An authenticated user can trigger the denial by submitting a large, token‑free rrule through the REST API, including the schedule preview endpoint, which does not enforce resource‑level RBAC. The attack requires only API access and can be performed repeatedly to exhaust worker resources, thereby denying service to legitimate users.