This advisory covers security fixes in Red Hat Satellite 6.18.3 and Red Hat OpenShift Service Mesh 3.0.7. The primary vulnerability is CVE-2025-53643, an HTTP Request/Response Smuggling issue in python-aiohttp, which arises from incorrect parsing of chunked trailer sections. Additional vulnerabilities in python3.12-urllib3 include a decompression-bomb safeguard bypass when following HTTP redirects (CVE-2026-21441) and improper handling of highly compressed data in the streaming API (CVE-2025-66471). These issues could allow attackers to manipulate HTTP traffic or cause unexpected behavior in HTTP clients. The fixes are included in updated packages for Red Hat Satellite 6.18.3 and OpenShift Service Mesh 3.0.7. The advisory recommends applying these updates after ensuring all prior errata are applied.

The vulnerabilities could allow an attacker to perform HTTP Request/Response Smuggling, potentially leading to manipulation of HTTP traffic between clients and servers. The decompression-bomb safeguard bypass and improper handling of compressed data in urllib3 could lead to resource exhaustion or unexpected processing behavior. These issues impact the integrity and reliability of HTTP communications in Red Hat Satellite and OpenShift Service Mesh environments. No known exploits in the wild have been reported at this time.

Red Hat has released official fixes for these vulnerabilities in Red Hat Satellite 6.18.3 and Red Hat OpenShift Service Mesh 3.0.7. Users should apply these updates promptly after confirming that all previously released errata relevant to their systems have been installed. Detailed update instructions are available in the Red Hat Satellite and OpenShift Service Mesh documentation. No additional mitigations are indicated by the vendor advisory.