The Red Hat Security Advisory RHSA-2026:1726 addresses three vulnerabilities in the python-urllib3 library affecting Red Hat Enterprise Linux 10.0 Extended Update Support. CVE-2025-66418 involves an unbounded decompression chain that can lead to resource exhaustion. CVE-2025-66471 concerns improper handling of highly compressed data in the urllib3 Streaming API. CVE-2026-21441 describes a vulnerability where the decompression-bomb safeguard can be bypassed when following HTTP redirects in the Streaming API. These issues relate to resource management and decompression safeguards within urllib3, potentially impacting system stability or security. Red Hat has provided updated packages to remediate these vulnerabilities. The advisory references multiple fixed package versions for various architectures. No CVSS scores are provided in the advisory, but the impact is rated as Important by Red Hat.

The vulnerabilities could allow an attacker to cause resource exhaustion on affected systems by exploiting unbounded decompression chains or bypassing decompression safeguards in urllib3's Streaming API. This could degrade system performance or availability. There are no reports of active exploitation in the wild. The issues affect Red Hat Enterprise Linux 10.0 Extended Update Support versions using the vulnerable python-urllib3 packages.

Red Hat has released updated python-urllib3 packages for Red Hat Enterprise Linux 10.0 Extended Update Support that address these vulnerabilities. Users should apply the updates as described in the Red Hat advisory RHSA-2026:1726 and the referenced article https://access.redhat.com/articles/11258. Applying these official patches is the recommended remediation. No alternative mitigations or workarounds are specified in the advisory.