Bug 2419455 (CVE-2025-66418)
| Summary: | CVE-2025-66418 urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abarbaro, adinn, adistefa, alcohan, alinfoot, alizardo, amctagga, anjoseph, anpicker, anthomas, aoconnor, aprice, bbrownin, bdettelb, bniver, bparees, brasmith, carogers, caswilli, cmyers, cochase, crizzo, dfreiber, dhanak, dnakabaa, doconnor, dranck, drosa, drow, dschmidt, dsimansk, dtrifiro, dymurray, eborisov, eglynn, ehelms, erezende, flucifre, galder, galder.zamarreno, ggainey, gmeno, gparvin, groman, gtanzill, haoli, hasun, hkataria, ibolton, jajackso, jbalunas, jburrell, jbuscemi, jcammara, jcantril, jchui, jdobes, jfula, jhe, jjoyce, jkoehler, jlanda, jmatthew, jmitchel, jmontleo, jneedle, joehler, jowilson, jprabhak, jpretori, jsamir, jschluet, juwatts, jwong, kaycoth, kbempah, kegrant, kgaikwad, kingland, koliveir, kshier, ktsao, kverlaen, lball, lbrazdil, lchilton, lcouzens, lgamliel, lhh, ljawale, lphiri, lsvaty, luizcosta, lwan, mabashia, manissin, matzew, mbabacek, mbenjamin, mburns, mgarciac, mhackett, mhess, mhulan, mminar, mnovotny, mrunge, mskarbek, nboldt, ngough, nmoumoul, nweather, nyancey, oaljalju, oezr, olubyans, omaciel, ometelka, orabin, osousa, owatkins, pahickey, pakotvan, pbohmill, pbraun, pcreech, pgaikwad, pgrist, pjindal, psrna, ptisnovs, rbiba, rbobbitt, rbryant, rchan, rekumar, rfreiman, rhaigner, rhel-process-autobot, rjohnson, rojacob, sausingh, sbiarozk, sdawley, sdoran, sfeifer, sgehwolf, shvarugh, simaishi, slucidi, smallamp, smcdonal, solenoci, sostapov, sseago, sskracic, stcannon, sthirugn, syedriko, teagle, tfister, thavo, tmalecek, tpfromme, tqvarnst, ttakamiy, tzivkovi, vereddy, veshanka, vimartin, vkumar, vle, vvoronko, vwilson, watson-tool-maintainers, weaton, whayutin, wtam, xdharmai, yguenane, zdohnal, zzhou |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain causes the client system to consume a virtually unbounded amount of CPU resources and memory. The high resource usage leads to service disruption, making the application unresponsive.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | 2422212, 2422213, 2422507, 2422508, 2422509, 2422510, 2422511, 2422512, 2422513, 2422514, 2422515, 2422591, 2431355, 2431356, 2431357, 2431358, 2431359 | ||
| Bug Blocks: | |||
|
Description
OSIDB Bzimport
2025-12-05 17:01:44 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:1086 https://access.redhat.com/errata/RHSA-2026:1086 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:1087 https://access.redhat.com/errata/RHSA-2026:1087 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:1089 https://access.redhat.com/errata/RHSA-2026:1089 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:1088 https://access.redhat.com/errata/RHSA-2026:1088 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:1224 https://access.redhat.com/errata/RHSA-2026:1224 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:1226 https://access.redhat.com/errata/RHSA-2026:1226 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:1241 https://access.redhat.com/errata/RHSA-2026:1241 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:1239 https://access.redhat.com/errata/RHSA-2026:1239 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:1240 https://access.redhat.com/errata/RHSA-2026:1240 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:1254 https://access.redhat.com/errata/RHSA-2026:1254 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:1330 https://access.redhat.com/errata/RHSA-2026:1330 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:1329 https://access.redhat.com/errata/RHSA-2026:1329 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:1331 https://access.redhat.com/errata/RHSA-2026:1331 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:1332 https://access.redhat.com/errata/RHSA-2026:1332 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:1337 https://access.redhat.com/errata/RHSA-2026:1337 This issue has been addressed in the following products: Red Hat Enterprise Linux 7 Extended Lifecycle Support Via RHSA-2026:1336 https://access.redhat.com/errata/RHSA-2026:1336 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:1340 https://access.redhat.com/errata/RHSA-2026:1340 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:1339 https://access.redhat.com/errata/RHSA-2026:1339 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:1338 https://access.redhat.com/errata/RHSA-2026:1338 This issue has been addressed in the following products: RHUI 4 for RHEL 8 Via RHSA-2026:1485 https://access.redhat.com/errata/RHSA-2026:1485 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:1546 https://access.redhat.com/errata/RHSA-2026:1546 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions Via RHSA-2026:1618 https://access.redhat.com/errata/RHSA-2026:1618 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:1619 https://access.redhat.com/errata/RHSA-2026:1619 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:1674 https://access.redhat.com/errata/RHSA-2026:1674 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:1676 https://access.redhat.com/errata/RHSA-2026:1676 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:1693 https://access.redhat.com/errata/RHSA-2026:1693 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:1702 https://access.redhat.com/errata/RHSA-2026:1702 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:1701 https://access.redhat.com/errata/RHSA-2026:1701 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:1704 https://access.redhat.com/errata/RHSA-2026:1704 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:1712 https://access.redhat.com/errata/RHSA-2026:1712 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:1726 https://access.redhat.com/errata/RHSA-2026:1726 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:1729 https://access.redhat.com/errata/RHSA-2026:1729 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Extended Update Support Via RHSA-2026:1957 https://access.redhat.com/errata/RHSA-2026:1957 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:2279 https://access.redhat.com/errata/RHSA-2026:2279 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On Via RHSA-2026:2723 https://access.redhat.com/errata/RHSA-2026:2723 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions Red Hat Enterprise Linux 8.6 Telecommunications Update Service Via RHSA-2026:2717 https://access.redhat.com/errata/RHSA-2026:2717 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions Red Hat Enterprise Linux 8.8 Telecommunications Update Service Via RHSA-2026:2718 https://access.redhat.com/errata/RHSA-2026:2718 This issue has been addressed in the following products: Red Hat Enterprise Linux 8.2 Advanced Update Support Via RHSA-2026:2728 https://access.redhat.com/errata/RHSA-2026:2728 This issue has been addressed in the following products: Red Hat Satellite 6.17 for RHEL 9 Via RHSA-2026:2764 https://access.redhat.com/errata/RHSA-2026:2764 This issue has been addressed in the following products: Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Via RHSA-2026:2765 https://access.redhat.com/errata/RHSA-2026:2765 |