This advisory covers three vulnerabilities in the python-urllib3 library as used in Red Hat Enterprise Linux 8.8 and related update services. CVE-2025-66418 describes an unbounded decompression chain that can cause resource exhaustion. CVE-2025-66471 involves improper handling of highly compressed data in the Streaming API. CVE-2026-21441 allows bypassing decompression-bomb safeguards when following HTTP redirects in the Streaming API. These issues relate to how urllib3 processes compressed data streams, potentially leading to excessive resource consumption. Red Hat has released updated python-urllib3 packages to address these vulnerabilities. The advisory references specific package versions and provides links for applying the update.

The vulnerabilities may allow an attacker to cause resource exhaustion on affected systems by exploiting unbounded decompression chains or bypassing decompression safeguards in urllib3's Streaming API. This could degrade system performance or availability. No evidence of active exploitation in the wild has been reported. The impact is rated as important by Red Hat, indicating a significant security concern but not necessarily critical.

Red Hat has released updated python-urllib3 packages for Red Hat Enterprise Linux 8.8 and related update services that fix these vulnerabilities. Users should apply the security update as detailed in the Red Hat advisory RHSA-2026:2718 and the referenced article https://access.redhat.com/articles/11258. Since this is an on-premises product, administrators must manually apply these updates to affected systems. No additional mitigation steps are specified by the vendor.