Red Hat Product Security issued an important security advisory (RHSA-2025:21141) for python-kdcproxy in Red Hat Enterprise Linux 10.0 Extended Update Support. The advisory addresses two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote denial of service vulnerability caused by unbounded TCP upstream buffering. These vulnerabilities affect python-kdcproxy versions included in Red Hat Enterprise Linux 10.0 across multiple architectures (x86_64, s390x, ppc64le, aarch64). The advisory provides updated packages to remediate these issues. No CVSS scores are provided in the advisory, but the severity is rated as important by Red Hat. No known exploits in the wild have been reported at the time of the advisory.

The SSRF vulnerability (CVE-2025-59088) could allow an unauthenticated attacker to induce the python-kdcproxy service to make arbitrary DNS SRV requests, potentially leading to information disclosure or further attacks depending on the environment. The remote DoS vulnerability (CVE-2025-59089) could allow an attacker to cause a denial of service by exploiting unbounded TCP upstream buffering, potentially disrupting service availability. Both vulnerabilities affect Red Hat Enterprise Linux 10.0 Extended Update Support versions of python-kdcproxy. No evidence of active exploitation is reported.

Red Hat has released updated python-kdcproxy packages for Red Hat Enterprise Linux 10.0 Extended Update Support to address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:21141 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will remediate both the SSRF and remote DoS vulnerabilities. No additional mitigation steps are indicated by the vendor advisory.