The vulnerability in latchset kdcproxy (CVE-2025-59089) involves the lack of bounds enforcement on TCP response lengths from KDC servers. During response reception, kdcproxy copies the entire buffered stream into new buffers on each recv() call, even if the transfer is incomplete, causing excessive memory and CPU consumption. Additionally, it accepts incoming response chunks as long as the received length does not exactly match the response header length, allowing attackers to send unbounded data until connection timeout (~12 seconds). Multiple concurrent exploit attempts can overflow the accept queue, resulting in denial-of-service to legitimate clients. This vulnerability has a CVSS 3.1 base score of 5.9 (medium severity) and does not impact confidentiality or integrity but affects availability. Red Hat has issued an official security advisory and patch for python-kdcproxy in Red Hat Enterprise Linux 9.6, 9.8, and related Extended Update Support and Extended Life Cycle versions.

Successful exploitation results in denial-of-service by exhausting server memory and CPU resources due to unbounded TCP upstream buffering in kdcproxy. This can also cause accept queue overflow, preventing legitimate client connections. There is no impact on confidentiality or integrity.

An official fix is available from Red Hat. Users should apply the python-kdcproxy security update provided in Red Hat Enterprise Linux 9.6, 9.8, and Extended Update Support and Extended Life Cycle releases. Refer to Red Hat advisory RHSA-2025:21138 and RHSA-2025:21139 and the update instructions at https://access.redhat.com/articles/11258. No additional mitigation is required once the patch is applied.