This advisory covers three security vulnerabilities in the python3.11-urllib3 package for Red Hat Enterprise Linux 9: CVE-2025-66418 involves an unbounded decompression chain that can cause resource exhaustion; CVE-2025-66471 concerns improper handling of highly compressed data in the urllib3 streaming API; and CVE-2026-21441 allows bypassing decompression-bomb safeguards when following HTTP redirects in the streaming API. These issues can lead to denial of service or resource exhaustion conditions. Red Hat has released an updated package (python3.11-urllib3-1.26.12-5.el9_7.1) that fixes these vulnerabilities. The advisory references multiple architectures and extended update support versions of Red Hat Enterprise Linux 9. No CVSS scores are provided in the advisory, but the severity is rated as important (high).

The vulnerabilities can lead to resource exhaustion and denial of service conditions due to unbounded decompression chains and improper handling of compressed data in the urllib3 streaming API. The bypass of decompression-bomb safeguards when following HTTP redirects increases the risk of such resource exhaustion attacks. These issues affect applications using the vulnerable urllib3 package for Python 3.11 on Red Hat Enterprise Linux 9, potentially impacting system stability and availability.

Red Hat has released an updated python3.11-urllib3 package version 1.26.12-5.el9_7.1 that addresses these vulnerabilities. Users should apply this security update as soon as possible. Detailed instructions for applying the update are available at https://access.redhat.com/articles/11258. No additional mitigations are indicated by the vendor advisory.