This advisory addresses three security vulnerabilities in the python3.12-urllib3 package used in Red Hat Enterprise Linux 9. The first vulnerability (CVE-2025-66418) involves an unbounded decompression chain that can cause resource exhaustion. The second (CVE-2025-66471) concerns improper handling of highly compressed data in the urllib3 streaming API. The third (CVE-2026-21441) allows bypassing the decompression-bomb safeguard when following HTTP redirects in the streaming API. These issues relate to how urllib3 processes compressed data streams, potentially leading to denial-of-service conditions. Red Hat has issued updated packages to address these vulnerabilities, and the advisory includes detailed information on affected versions and fixes.

The vulnerabilities can lead to resource exhaustion through unbounded decompression chains or improper handling of compressed data, potentially causing denial-of-service conditions. Additionally, the bypass of decompression-bomb safeguards when following HTTP redirects could allow an attacker to circumvent protections designed to prevent excessive resource consumption. There are no known exploits in the wild at this time. The overall security impact is rated as important by Red Hat.

Red Hat has released updated python3.12-urllib3 packages for Red Hat Enterprise Linux 9 that address these vulnerabilities. Users should apply these official updates as detailed in the Red Hat advisory RHSA-2026:1088 and the referenced article https://access.redhat.com/articles/11258. Applying these updates will mitigate the identified issues. No additional mitigation steps are indicated or required beyond applying the official patches.