Skip to main content
CVE-2025-66471VulnerabilityPublished Updated

Red Hat Security Advisory: General availability of the satellite/iop-host-inventory-frontend-rhel9 container image

Affects Red HatSource GCVE Database

0
Compare

Not known to be exploited.

Data as of 30 Oct 2026, 11:52 UTC

Severity
High

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS
0.6% chance of exploitation in 30 days – higher than 52% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

Exploitation evidence

  1. Disclosed: evidence found.

    CVE published 1 Jul 2026

  2. Detectable: no evidence on record.

    No public nuclei template indexed

  3. Weaponized: no evidence on record.

    No public exploit code indexed in Metasploit or Exploit-DB

  4. Exploited in the wild: no evidence on record.

    Not in CISA KEV and no source reports exploitation

  5. Observed by OffSeq Mirage: no evidence on record.

    No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 30 Oct 2026.

What to do

AI-suggested

Currently, no mitigation or patch is available that meets Red Hat's criteria for ease of deployment, applicability, or stability. Users should monitor Red Hat advisories for future updates.

Description

A decompression handling flaw in urllib3's streaming API can cause excessive resource consumption on the client side when processing highly compressed data. This flaw may lead to high CPU usage and large memory allocations even when only small chunks of data are requested, posing a denial-of-service risk. The issue affects applications using urllib3 versions prior to 2.6.0. Red Hat Satellite includes Red Hat Lightspeed, which uses urllib3 and is impacted by this vulnerability. No fix is currently available that meets Red Hat's criteria for deployment and stability.

References

Community reviews

Loading reviews…