Red Hat Product Security released an advisory (RHSA-2025:21138) for python-kdcproxy in Red Hat Enterprise Linux 9.6 Extended Update Support, addressing two vulnerabilities: CVE-2025-59088, an unauthenticated SSRF vulnerability via realm-controlled DNS SRV records, and CVE-2025-59089, a remote DoS vulnerability due to unbounded TCP upstream buffering. These vulnerabilities affect python-kdcproxy versions prior to the updated package 1.0.0-9.el9_6. The advisory provides updated packages for multiple architectures including x86_64, s390x, ppc64le, and aarch64. The update is rated as Important by Red Hat. No CVSS scores are provided in the advisory, and no known exploits in the wild have been reported.

The SSRF vulnerability (CVE-2025-59088) could allow an unauthenticated attacker to induce the python-kdcproxy service to make unintended network requests, potentially exposing internal services or data. The remote DoS vulnerability (CVE-2025-59089) could allow an attacker to cause a denial of service by exploiting unbounded TCP upstream buffering, potentially disrupting service availability. Both vulnerabilities impact the security and reliability of systems running the affected python-kdcproxy versions on Red Hat Enterprise Linux 9.6 Extended Update Support.

Red Hat has released updated python-kdcproxy packages (version 1.0.0-9.el9_6) that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.6 Extended Update Support should apply these security updates promptly by following the instructions in the Red Hat advisory (https://access.redhat.com/articles/11258). No additional mitigations are specified or required beyond applying the official update.