The Red Hat Security Advisory RHSA-2026:1619 addresses three vulnerabilities in the python3.12-urllib3 package: CVE-2025-66418 involves an unbounded decompression chain that can cause resource exhaustion; CVE-2025-66471 concerns improper handling of highly compressed data by the urllib3 streaming API; and CVE-2026-21441 is a decompression-bomb safeguard bypass vulnerability when following HTTP redirects in the streaming API. These issues could lead to denial of service or resource exhaustion conditions. The advisory applies to Red Hat Enterprise Linux 9.6 Extended Update Support and related variants. The update to python3.12-urllib3 version 1.26.19-1.el9_6.1 includes fixes for these vulnerabilities. No CVSS scores are provided in the advisory, but the severity is rated as important (high). No known exploits in the wild have been reported at this time.

The vulnerabilities in urllib3 can lead to resource exhaustion through unbounded decompression chains and improper handling of highly compressed data, potentially causing denial of service conditions. The decompression-bomb safeguard bypass when following HTTP redirects could allow attackers to circumvent protections designed to prevent excessive resource consumption. These impacts affect systems using the vulnerable python3.12-urllib3 package on Red Hat Enterprise Linux 9.6 Extended Update Support and related variants.

Red Hat has released an updated python3.12-urllib3 package version 1.26.19-1.el9_6.1 that addresses these vulnerabilities. Users should apply this security update promptly to remediate the issues. For detailed instructions on applying the update, refer to the Red Hat article at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.