Red Hat Security Advisory: python-kdcproxy security update
Two security vulnerabilities have been identified in the python-kdcproxy component of Red Hat Enterprise Linux 9. These include an unauthenticated Server-Side Request Forgery (SSRF) via realm-controlled DNS SRV records (CVE-2025-59088) and a remote denial of service (DoS) caused by unbounded TCP upstream buffering (CVE-2025-59089). Red Hat has issued an important security update addressing these issues. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 9. Users are advised to apply the update as detailed in the Red Hat advisory.
AI Analysis
Technical Summary
The python-kdcproxy package in Red Hat Enterprise Linux 9 contains two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote denial of service vulnerability due to unbounded TCP upstream buffering. These vulnerabilities could allow an attacker to cause unintended network requests or disrupt service availability. Red Hat has released updated python-kdcproxy packages to remediate these issues. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. Detailed patch instructions are provided in the Red Hat advisory RHSA-2025:21139.
Potential Impact
The SSRF vulnerability (CVE-2025-59088) allows unauthenticated attackers to induce the server to make arbitrary network requests, potentially leading to information disclosure or interaction with internal services. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP buffering. Both vulnerabilities impact the availability and security of systems running python-kdcproxy on Red Hat Enterprise Linux 9.
Mitigation Recommendations
Red Hat has released an official security update for python-kdcproxy in Red Hat Enterprise Linux 9 addressing these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2025:21139 and the related article https://access.redhat.com/articles/11258. This update is available for all supported architectures and variants of Red Hat Enterprise Linux 9. Applying this update mitigates the SSRF and DoS vulnerabilities.
Red Hat Security Advisory: python-kdcproxy security update
Description
Two security vulnerabilities have been identified in the python-kdcproxy component of Red Hat Enterprise Linux 9. These include an unauthenticated Server-Side Request Forgery (SSRF) via realm-controlled DNS SRV records (CVE-2025-59088) and a remote denial of service (DoS) caused by unbounded TCP upstream buffering (CVE-2025-59089). Red Hat has issued an important security update addressing these issues. The update is available for multiple architectures and variants of Red Hat Enterprise Linux 9. Users are advised to apply the update as detailed in the Red Hat advisory.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The python-kdcproxy package in Red Hat Enterprise Linux 9 contains two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote denial of service vulnerability due to unbounded TCP upstream buffering. These vulnerabilities could allow an attacker to cause unintended network requests or disrupt service availability. Red Hat has released updated python-kdcproxy packages to remediate these issues. The advisory covers multiple architectures including x86_64, s390x, ppc64le, and aarch64. Detailed patch instructions are provided in the Red Hat advisory RHSA-2025:21139.
Potential Impact
The SSRF vulnerability (CVE-2025-59088) allows unauthenticated attackers to induce the server to make arbitrary network requests, potentially leading to information disclosure or interaction with internal services. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP buffering. Both vulnerabilities impact the availability and security of systems running python-kdcproxy on Red Hat Enterprise Linux 9.
Mitigation Recommendations
Red Hat has released an official security update for python-kdcproxy in Red Hat Enterprise Linux 9 addressing these vulnerabilities. Users should apply the update as described in the Red Hat advisory RHSA-2025:21139 and the related article https://access.redhat.com/articles/11258. This update is available for all supported architectures and variants of Red Hat Enterprise Linux 9. Applying this update mitigates the SSRF and DoS vulnerabilities.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:21139
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-59089"]
Threat ID: 6a419cac27e9c79719ab96a0
Added to database: 06/28/2026, 22:14:04 UTC
Last enriched: 06/28/2026, 22:21:19 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 27
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.