The Red Hat Security Advisory RHSA-2026:1089 reports three vulnerabilities in the python3.11-urllib3 package used in Red Hat Enterprise Linux 9. CVE-2025-66418 involves an unbounded decompression chain that can cause resource exhaustion. CVE-2025-66471 concerns improper handling of highly compressed data in the urllib3 Streaming API. CVE-2026-21441 describes a vulnerability where the decompression-bomb safeguard can be bypassed when following HTTP redirects in the Streaming API. These issues relate to resource exhaustion and decompression bomb protections in the urllib3 library. Red Hat has issued updated packages that address these vulnerabilities across multiple architectures and variants of RHEL 9.

The vulnerabilities could lead to resource exhaustion on affected systems due to unbounded decompression chains or improper handling of compressed data. The bypass of decompression-bomb safeguards may allow attackers to circumvent protections designed to prevent denial-of-service conditions caused by maliciously crafted compressed data. No known exploits in the wild have been reported at this time. The impact is rated as Important by Red Hat, indicating a significant security risk if unpatched.

Red Hat has released updated python3.11-urllib3 packages for Red Hat Enterprise Linux 9 that fix these vulnerabilities. Users should apply the security update as described in Red Hat advisory RHSA-2026:1089 and the referenced article https://access.redhat.com/articles/11258 to remediate these issues. No additional mitigation steps are indicated beyond applying the official patches.