This advisory addresses three security vulnerabilities in the urllib3 library as used by the fence-agents packages in Red Hat Enterprise Linux 9. CVE-2025-66418 involves an unbounded decompression chain that can cause resource exhaustion. CVE-2025-66471 concerns improper handling of highly compressed data in the urllib3 Streaming API. CVE-2026-21441 describes a vulnerability where the decompression-bomb safeguard can be bypassed when following HTTP redirects in the streaming API. These vulnerabilities could potentially impact the stability and reliability of cluster node management by exhausting resources or mishandling compressed data streams. Red Hat has released updated fence-agents packages to address these issues.

The vulnerabilities can lead to resource exhaustion on systems running affected versions of fence-agents due to unbounded decompression chains and improper handling of compressed data. This could disrupt cluster node management by causing failures or instability when forcibly restarting or removing nodes. The issues specifically affect the urllib3 library's handling of compressed data streams, which is critical for remote power management scripts. No known exploits in the wild have been reported at this time.

Red Hat has issued an important security update for fence-agents in Red Hat Enterprise Linux 9 to address these vulnerabilities. Users should apply the update as detailed in the Red Hat advisory RHSA-2026:1239 and the referenced article https://access.redhat.com/articles/11258. The update fixes the issues in the urllib3 library used by fence-agents. No additional mitigation steps are indicated beyond applying the official update.