CVE-2025-66418 describes a resource exhaustion vulnerability in the urllib3 Python library, which is used by the cert-manager Operator for Red Hat OpenShift and other Red Hat products. A remote attacker can exploit this by sending an HTTP response with an unlimited decompression chain, causing the client to consume excessive CPU and memory resources. This results in a denial of service condition. The vulnerability is associated with CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409. Red Hat's advisory indicates the issue affects multiple products including Red Hat Satellite and Red Hat Enterprise Linux components. The advisory does not confirm availability of a patch or fix at this time.

Successful exploitation causes denial of service through resource exhaustion on affected systems, making applications unresponsive due to excessive CPU and memory consumption. There is no impact on confidentiality or integrity reported. The vulnerability affects availability of services relying on urllib3 in the affected Red Hat products.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Red Hat has not provided an official fix or update in the advisory. Users should monitor Red Hat's security advisories and apply updates once available. No vendor-provided mitigations or workarounds are currently documented.