Red Hat Satellite provides a container image for running an MCP server locally, designed for advanced reporting and AI-driven data analysis. The advisory includes CVE-2025-66418, a vulnerability in the urllib3 Python library that allows a remote malicious server to cause a denial of service by sending HTTP responses with excessive chained compression algorithms. This leads to unbounded CPU and memory consumption, disrupting service availability. The advisory lists additional CVEs but does not detail them. No official fix or patch is currently available for Red Hat Satellite 6.18. The advisory references Red Hat documentation for MCP integration but does not specify mitigation steps. No known exploits in the wild have been reported.

The primary impact is a denial of service condition caused by resource exhaustion (CPU and memory) when processing malicious HTTP responses with excessive compression chains. This can make the affected application unresponsive, disrupting availability. No confidentiality or integrity impacts are reported. The vulnerability affects Red Hat Satellite 6.18 via the urllib3 library used in the MCP server container image.

The vendor advisory does not currently provide an official fix or patch for the vulnerabilities. No specific mitigation steps are described in the advisory. Users should monitor Red Hat's official channels for updates and consider consulting Red Hat Satellite documentation for MCP integration guidance. Since this is a Technology Preview container image, cautious deployment and limiting exposure may reduce risk. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.