The python-urllib3 library in Red Hat products contains multiple vulnerabilities related to decompression handling. CVE-2025-66418 describes an unbounded decompression chain that allows a remote malicious server to cause resource exhaustion by responding with an HTTP message containing excessive chained compression algorithms, leading to high CPU and memory consumption and resulting in denial of service. CVE-2025-66471 involves improper handling of highly compressed data in the streaming API, and CVE-2026-21441 describes a bypass of decompression-bomb safeguards when following HTTP redirects in the streaming API. These vulnerabilities are categorized under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Handling of Highly Compressed Data). Red Hat has issued security advisories acknowledging these issues but has not explicitly confirmed patch availability in the provided content.

Exploitation of these vulnerabilities can lead to denial of service conditions by causing the affected system to consume excessive CPU and memory resources. This can disrupt services and make applications unresponsive. There is no indication of confidentiality or integrity impact. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the Red Hat vendor advisory for current remediation guidance. Until a fix is available, users should monitor Red Hat security advisories for updates. No vendor-provided mitigations or workarounds are specified in the advisory content. Customers with Red Hat Technical Account Managers may consult them for further guidance.