The fence-agents packages in Red Hat Enterprise Linux 9.4 EUS and related variants include scripts for managing remote power control of cluster nodes. Two security vulnerabilities in the urllib3 streaming API used by these packages have been identified: CVE-2025-66471, where highly compressed data is improperly handled, and CVE-2026-21441, where the decompression-bomb safeguard can be bypassed when following HTTP redirects. These vulnerabilities could allow maliciously crafted data to impact the functionality or security of the cluster management processes. Red Hat has issued an important security update (RHSA-2026:1717) that addresses these issues by updating the fence-agents packages. The advisory references detailed CVE pages for further information. The vulnerabilities are rated as having important security impact by Red Hat, with no CVSS scores provided in the advisory.

The vulnerabilities affect the urllib3 streaming API used by fence-agents, potentially allowing improper handling of compressed data and bypass of decompression-bomb safeguards. This could lead to resource exhaustion or denial of service conditions during cluster node management operations. The impact is limited to environments using the affected fence-agents packages on Red Hat Enterprise Linux 9.4 EUS and related variants. There are no known exploits in the wild at this time.

Red Hat has released updated fence-agents packages that address these vulnerabilities. Users should apply the security update RHSA-2026:1717 as detailed in the Red Hat advisory (https://access.redhat.com/articles/11258) to remediate the issues. No additional mitigation steps are indicated by the vendor beyond applying the official update.