The Red Hat security advisory RHSA-2026:1618 reports three vulnerabilities in the python-urllib3 library used in Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions. CVE-2025-66418 describes an unbounded decompression chain that can lead to resource exhaustion. CVE-2025-66471 involves improper handling of highly compressed data in the urllib3 Streaming API. CVE-2026-21441 allows bypassing decompression-bomb safeguards when following HTTP redirects in the Streaming API. These issues relate to resource exhaustion and decompression bomb protections, categorized under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Resource Shutdown or Release). Red Hat has issued updated python-urllib3 packages (version 1.26.5-3.el9_0.2) to fix these vulnerabilities.

The vulnerabilities can lead to resource exhaustion on affected systems by exploiting unbounded decompression chains or bypassing decompression bomb safeguards in the urllib3 library. This could degrade system performance or availability. The improper handling of highly compressed data in the Streaming API may also cause unexpected behavior or denial of service conditions. No known exploits in the wild have been reported at this time.

Red Hat has released updated python-urllib3 packages that address these vulnerabilities. Users of Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions should apply the security update python-urllib3-1.26.5-3.el9_0.2 or later as provided by Red Hat. Detailed update instructions are available at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.