Red Hat Satellite 6.18.3 for RHEL 9 addresses three security vulnerabilities: CVE-2025-53643 in python-aiohttp involving HTTP request/response smuggling, CVE-2026-21441 in python3.12-urllib3 that allows bypass of decompression-bomb safeguards when following HTTP redirects in the streaming API, and CVE-2025-66471 in python3.12-urllib3 where the streaming API improperly handles highly compressed data. These vulnerabilities could potentially be exploited to disrupt or manipulate HTTP communications or processing of compressed data within the Satellite management environment. The advisory recommends applying the update after ensuring all previous errata are applied.

The vulnerabilities could allow an attacker to perform HTTP request/response smuggling or bypass safeguards designed to prevent decompression bombs, potentially leading to unexpected behavior or resource exhaustion in Red Hat Satellite environments. The improper handling of highly compressed data may also lead to processing anomalies. No known exploits in the wild have been reported. The impact is rated as important by Red Hat, indicating a significant security concern but not critical.

Red Hat has released Red Hat Satellite 6.18.3 which includes fixes for these vulnerabilities. Users should apply this update after confirming that all previously released errata relevant to their system have been installed. Detailed update instructions are available in the Red Hat Satellite documentation. No additional mitigation steps are indicated by the vendor advisory.