Red Hat Security Advisory: python-kdcproxy security update
Two security vulnerabilities have been identified in the python-kdcproxy component of Red Hat Enterprise Linux 9.4 Extended Update Support. The first is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability via realm-controlled DNS SRV records (CVE-2025-59088). The second is a remote denial-of-service (DoS) vulnerability caused by unbounded TCP upstream buffering (CVE-2025-59089). Red Hat has released an important security update addressing these issues for multiple architectures and variants of RHEL 9.4.
AI Analysis
Technical Summary
Red Hat Product Security has issued an advisory (RHSA-2025:21748) for python-kdcproxy in Red Hat Enterprise Linux 9.4 Extended Update Support. The advisory addresses two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote DoS vulnerability due to unbounded TCP upstream buffering. These vulnerabilities affect python-kdcproxy and can be exploited remotely. The update fixes these issues by patching the python-kdcproxy package. The advisory covers multiple RHEL 9.4 variants and architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat.
Potential Impact
The SSRF vulnerability (CVE-2025-59088) allows an unauthenticated attacker to induce the python-kdcproxy service to make unintended network requests, potentially exposing internal services or data. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP buffering. Both vulnerabilities can be exploited remotely and may impact availability and confidentiality of affected systems running vulnerable versions of python-kdcproxy on RHEL 9.4 Extended Update Support.
Mitigation Recommendations
Red Hat has released updated python-kdcproxy packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:21748 and the referenced article https://access.redhat.com/articles/11258. Applying this official patch fully mitigates the vulnerabilities. No additional mitigations are specified or required beyond installing the update.
Red Hat Security Advisory: python-kdcproxy security update
Description
Two security vulnerabilities have been identified in the python-kdcproxy component of Red Hat Enterprise Linux 9.4 Extended Update Support. The first is an unauthenticated Server-Side Request Forgery (SSRF) vulnerability via realm-controlled DNS SRV records (CVE-2025-59088). The second is a remote denial-of-service (DoS) vulnerability caused by unbounded TCP upstream buffering (CVE-2025-59089). Red Hat has released an important security update addressing these issues for multiple architectures and variants of RHEL 9.4.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Red Hat Product Security has issued an advisory (RHSA-2025:21748) for python-kdcproxy in Red Hat Enterprise Linux 9.4 Extended Update Support. The advisory addresses two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote DoS vulnerability due to unbounded TCP upstream buffering. These vulnerabilities affect python-kdcproxy and can be exploited remotely. The update fixes these issues by patching the python-kdcproxy package. The advisory covers multiple RHEL 9.4 variants and architectures including x86_64, s390x, ppc64le, and aarch64. No CVSS scores are provided in the advisory, but the severity is rated as Important by Red Hat.
Potential Impact
The SSRF vulnerability (CVE-2025-59088) allows an unauthenticated attacker to induce the python-kdcproxy service to make unintended network requests, potentially exposing internal services or data. The remote DoS vulnerability (CVE-2025-59089) can cause service disruption by exhausting resources through unbounded TCP buffering. Both vulnerabilities can be exploited remotely and may impact availability and confidentiality of affected systems running vulnerable versions of python-kdcproxy on RHEL 9.4 Extended Update Support.
Mitigation Recommendations
Red Hat has released updated python-kdcproxy packages for Red Hat Enterprise Linux 9.4 Extended Update Support that address these vulnerabilities. Users should apply the security update as described in the Red Hat advisory RHSA-2025:21748 and the referenced article https://access.redhat.com/articles/11258. Applying this official patch fully mitigates the vulnerabilities. No additional mitigations are specified or required beyond installing the update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- Red Hat Product Security
- Advisory Id
- RHSA-2025:21748
- Cve Count
- 2
- Additional Cves
- ["CVE-2025-59089"]
Threat ID: 6a419cab27e9c79719ab8fc1
Added to database: 06/28/2026, 22:14:03 UTC
Last enriched: 06/28/2026, 22:20:10 UTC
Last updated: 09/10/2026, 19:36:51 UTC
Views: 25
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.