Red Hat Product Security issued an advisory (RHSA-2025:21142) for python-kdcproxy in Red Hat Enterprise Linux 10, addressing two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF via realm-controlled DNS SRV records, and CVE-2025-59089, a remote DoS via unbounded TCP upstream buffering. The vulnerabilities affect multiple architectures of Red Hat Enterprise Linux 10 and its Extended Update Support and Extended Life Cycle variants. Red Hat has released updated python-kdcproxy packages to remediate these issues. No CVSS scores are provided in the advisory. The vulnerabilities correspond to CWE-918 (SSRF) and CWE-770 (Allocation of Resources Without Limits or Throttling).

The SSRF vulnerability (CVE-2025-59088) allows an unauthenticated attacker to induce the python-kdcproxy service to make unintended network requests, potentially leading to information disclosure or interaction with internal services. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP upstream buffering. Both vulnerabilities pose a high security risk as rated by Red Hat.

Red Hat has released updated python-kdcproxy packages for Red Hat Enterprise Linux 10 and its variants that fix these vulnerabilities. Users should apply these official updates promptly. For detailed update instructions, refer to Red Hat's advisory and article at https://access.redhat.com/articles/11258. No additional mitigations are specified or required beyond applying the official patches.