CVE-2025-66418 is a denial of service vulnerability in the urllib3 Python library, which is used by the Red Hat Trusted Artifact Signer (RHTAS) Operator compatible with OpenShift Container Platform versions 4.16 to 4.20. A remote attacker can exploit this flaw by responding with an HTTP message containing an unlimited chain of compression algorithms, causing the client to consume excessive CPU and memory resources, resulting in service disruption. The vulnerability is classified under CWE-770 (Allocation of Resources Without Limits or Throttling) and CWE-409 (Improper Resource Shutdown or Release). The Red Hat advisory RHSA-2026:2126 confirms the affected versions and the lack of a current fix. No known exploits are reported in the wild.

Exploitation of this vulnerability leads to denial of service through resource exhaustion on the client system running the affected urllib3 library within RHTAS. The excessive decompression chain causes high CPU and memory usage, making the application unresponsive and disrupting service availability. There is no impact on confidentiality or integrity reported.

No official fix or patch is currently available for this vulnerability in Red Hat Trusted Artifact Signer 1.3.2 or the affected OpenShift versions. Users should monitor Red Hat advisories for updates. Since this is a resource exhaustion issue triggered by malicious HTTP responses, consider limiting exposure to untrusted or malicious servers and applying network-level controls to restrict communications to trusted endpoints. Engage with Red Hat support or a Technical Account Manager for tailored guidance. Avoid deploying vulnerable versions in high-risk environments until a fix is released.