Two security vulnerabilities affect the python-kdcproxy component of Red Hat Identity Management (IdM) in Red Hat Enterprise Linux 8. CVE-2025-59088 is an unauthenticated SSRF vulnerability that can be triggered via realm-controlled DNS SRV records. CVE-2025-59089 is a remote denial of service vulnerability caused by unbounded TCP upstream buffering. Red Hat has issued an update (RHSA-2025:21140) to fix these issues for multiple architectures and extended life cycle versions of RHEL 8. The advisory rates the update as Important and provides packages to remediate the vulnerabilities.

The SSRF vulnerability (CVE-2025-59088) allows unauthenticated attackers to induce the python-kdcproxy service to make arbitrary network requests, potentially leading to information disclosure or further attacks. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP buffering. Both vulnerabilities affect the security and availability of the IdM service in enterprise environments.

Red Hat has released an official security update (RHSA-2025:21140) for Red Hat Enterprise Linux 8 that addresses these vulnerabilities. Users should apply the provided update packages to remediate the issues. For detailed update instructions, refer to Red Hat's official guidance at https://access.redhat.com/articles/11258. No additional mitigations are specified by the vendor advisory.