This advisory covers three security vulnerabilities in the urllib3 library used by python3.12 on Red Hat Enterprise Linux 9. CVE-2025-66418 involves an unbounded decompression chain that can lead to resource exhaustion. CVE-2025-66471 concerns improper handling of highly compressed data in the streaming API, potentially causing issues during decompression. CVE-2026-21441 describes a vulnerability where the decompression-bomb safeguard can be bypassed when following HTTP redirects in the streaming API. These vulnerabilities could allow an attacker to exhaust system resources or bypass safeguards designed to prevent decompression bombs. Red Hat has issued a security update (python3.12-urllib3-1.26.19-1.el9_7.1) to fix these issues.

The vulnerabilities can lead to resource exhaustion on affected systems due to unbounded decompression chains or improper handling of compressed data. This may cause denial of service or degraded system performance. The decompression-bomb safeguard bypass could allow an attacker to circumvent protections against maliciously crafted compressed data, increasing the risk of resource exhaustion attacks. No known exploits in the wild have been reported at this time.

Red Hat has released an updated package python3.12-urllib3-1.26.19-1.el9_7.1 that addresses these vulnerabilities. Users of Red Hat Enterprise Linux 9 with the affected package should apply this update promptly. For detailed update instructions, refer to the Red Hat advisory at https://access.redhat.com/articles/11258. No additional mitigation steps are indicated by the vendor advisory.