Two vulnerabilities affecting the python-kdcproxy component of Red Hat Identity Management (IdM) on Red Hat Enterprise Linux 8.2 have been identified and fixed. CVE-2025-59088 is an unauthenticated SSRF vulnerability exploitable via realm-controlled DNS SRV records, allowing an attacker to induce the server to make unintended network requests. CVE-2025-59089 is a remote Denial of Service vulnerability caused by unbounded TCP upstream buffering, which can exhaust resources and disrupt service availability. Red Hat has issued an important security advisory (RHSA-2025:21821) providing updates to mitigate these vulnerabilities. The advisory includes instructions for applying the update and references to the CVE pages for further details.

Successful exploitation of CVE-2025-59088 could allow an unauthenticated attacker to perform SSRF attacks, potentially leading to unauthorized network interactions from the vulnerable system. CVE-2025-59089 could enable a remote attacker to cause a denial of service by exhausting resources through unbounded TCP buffering, impacting service availability. Both vulnerabilities affect the python-kdcproxy component within Red Hat IdM on Red Hat Enterprise Linux 8.2. No known exploits in the wild have been reported at this time.

Red Hat has released an important security update for Red Hat Enterprise Linux 8.2 that addresses these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2025:21821 and the referenced article https://access.redhat.com/articles/11258. Since this is a traditional on-premises product, remediation requires applying the vendor-provided patch. There is no indication that no action is required or that the issue is already mitigated without patching.