The Red Hat Trusted Artifact Signer (RHTAS) OpenShift Operator versions 1.2.0 through 1.2.2 are affected by multiple vulnerabilities, including CVE-2025-66418. This CVE describes a denial of service vulnerability in the urllib3 Python library, where a remote attacker can cause resource exhaustion by sending HTTP responses with an excessive number of chained compression algorithms. This leads to unbounded CPU and memory usage, causing service disruption. The advisory references CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409. The vulnerabilities affect the integrity and availability of software supply chain processes that rely on RHTAS. The vendor advisory does not list any fixes or patches for these issues as of the publication date. The affected versions are explicitly stated as >=1.2.0 <=1.2.2. The product is a self-managed on-premise deployment of the Sigstore project used to cryptographically sign and verify software artifacts.

The primary impact is denial of service due to resource exhaustion (CPU and memory) caused by unbounded decompression chains in urllib3. This can make applications using RHTAS unresponsive, disrupting software supply chain operations that depend on artifact signing and verification. There is no indication of confidentiality or integrity compromise from the provided data. No known exploits in the wild have been reported.

The vendor advisory does not currently provide any fixes or patches for these vulnerabilities. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Red Hat's official channels for updates and consider mitigating exposure by limiting access to affected components or applying any recommended configuration changes once available. Since this is a self-managed on-premise deployment, vendor-managed remediation does not apply.