The vulnerability CVE-2025-66471 affects urllib3's streaming API decompression logic. When decompressing HTTP responses with content-encoding such as gzip, deflate, br, or zstd, urllib3 may fully decompress a small chunk of highly compressed data in one operation, leading to excessive resource consumption (high CPU usage and large memory allocation). This flaw can be exploited by sending specially crafted compressed data to client applications using vulnerable urllib3 versions before 2.6.0, potentially causing denial-of-service. Red Hat products that bundle affected urllib3 versions are impacted. The issue is tracked under CWE-409 (Improper Handling of Highly Compressed Data). Red Hat currently has no official fix or mitigation that meets their deployment criteria.

Exploitation of this vulnerability can cause denial-of-service on client systems by consuming excessive CPU and memory resources during decompression of highly compressed HTTP responses. This can degrade system performance or cause crashes. There is no impact on confidentiality or integrity reported. The vulnerability affects client-side applications using urllib3 versions prior to 2.6.0 bundled in various Red Hat products. No known exploits in the wild have been reported.

As per the Red Hat advisory, no official fix or mitigation currently meets Red Hat's criteria for deployment. Users should be cautious when processing highly compressed data from untrusted sources using affected urllib3 versions. Monitoring for updates from Red Hat is recommended. Customers with a Technical Account Manager (TAM) can consult directly for guidance. Upgrading to urllib3 version 2.6.0 or later, where the issue is fixed upstream, may mitigate the risk but is not officially provided by Red Hat at this time.