The Red Hat Trusted Artifact Signer (RHTAS) Operator, compatible with OpenShift Container Platform 4.15 to 4.19, is affected by multiple vulnerabilities including CVE-2025-66418. This specific CVE describes a flaw in the urllib3 Python library where a remote attacker can cause a denial of service by sending an HTTP response with an unlimited decompression chain, leading to unbounded CPU and memory consumption. The advisory references additional CVEs (CVE-2025-66471, CVE-2025-66506, CVE-2026-21441, CVE-2026-22772) but does not provide detailed descriptions for these. No patches or fixes are currently provided in the advisory, and no known exploits are reported in the wild. The vulnerabilities relate to resource exhaustion and improper resource allocation (CWE-770, CWE-409, CWE-405, CWE-918).

Exploitation of CVE-2025-66418 can lead to denial of service conditions by exhausting CPU and memory resources on affected systems, rendering applications unresponsive. This impacts the availability of services relying on the urllib3 library within the Red Hat Trusted Artifact Signer environment. The advisory does not specify impacts for the other CVEs but groups them under the same security advisory. No known active exploitation has been reported.

The vendor advisory does not currently provide any patches or fixes for these vulnerabilities. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should monitor Red Hat's official channels for updates and consider applying any future patches promptly. No vendor-stated mitigations or workarounds are provided at this time.