The Red Hat Security Advisory RHSA-2026:1729 addresses three vulnerabilities in the python-urllib3 package affecting Red Hat Enterprise Linux 9.6 Extended Update Support. CVE-2025-66418 describes an unbounded decompression chain that can lead to resource exhaustion. CVE-2025-66471 involves improper handling of highly compressed data in the urllib3 streaming API. CVE-2026-21441 details a bypass of the decompression-bomb safeguard when following HTTP redirects in the streaming API. These issues could cause denial-of-service conditions due to resource exhaustion. Red Hat has released updated python-urllib3 packages to fix these vulnerabilities across multiple architectures and product variants. The advisory rates the security impact as Important (high severity).

The vulnerabilities can lead to resource exhaustion on affected systems by exploiting unbounded decompression chains or bypassing decompression safeguards, potentially causing denial-of-service conditions. There are no known exploits in the wild at this time. The impact is primarily on system availability and stability when processing specially crafted compressed data via urllib3.

Red Hat has released updated python-urllib3 packages for Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. Applying these official updates will remediate the vulnerabilities. Users should follow Red Hat's guidance at https://access.redhat.com/articles/11258 to apply the security update. No alternative mitigations or workarounds are specified. Patch status is confirmed as fixed by the vendor advisory.