RHSA-2026:2764

Vulnerability from csaf_redhat - Published: 2026-02-16 19:06 - Updated: 2026-10-08 23:34
Summary
Red Hat Security Advisory: Satellite 6.17.6.3 Async Update
Severity
Important
Notes
Topic: A new release is now available for Red Hat Satellite 6.17 for RHEL 9.
Details: Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity to provide public Internet access to their servers or other client systems. It performs provisioning and configuration management of predefined standard operating environments. Security Fix(es): * python-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471) * python-urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441) * python-urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418) Bug Fix(es): * Satellite upgrade from 6.17.5 to 6.18 failed during Pulpcore database migration due to incompatible versions detected for some of the pulpcore plugins (SAT-41761)
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain causes the client system to consume a virtually unbounded amount of CPU resources and memory. The high resource usage leads to service disruption, making the application unresponsive.

CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Product Identifier Version Remediation
Unresolved product id: 9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src —
Vendor Fix fix
Workaround
Unresolved product id: 9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch —
Vendor Fix fix
Workaround
Product Identifier Version Remediation
Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src —
Workaround
Unresolved product id: 9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch —
Workaround
Unresolved product id: 9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch —
Workaround
Threats
Impact Important

A decompression handling flaw has been discovered in urllib3. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Fixed 4 products, the same list as for CVE-2025-66418
Known not affected 17 products, the same list as for CVE-2025-66418
Threats
Impact Important

A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassing decompression bomb safeguards. This issue leads to high memory and processor consumption, resulting in a Denial of Service (DoS) on the client.

CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Fixed 4 products, the same list as for CVE-2025-66418
Known not affected 17 products, the same list as for CVE-2025-66418
Threats
Impact Important
References

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "A new release is now available for Red Hat Satellite 6.17 for RHEL 9.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Satellite is a system management solution that allows organizations\nto configure and maintain their systems without the necessity to provide\npublic Internet access to their servers or other client systems. It\nperforms provisioning and configuration management of predefined standard\noperating environments.\n\nSecurity Fix(es):\n\n* python-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)\n\n* python-urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) (CVE-2026-21441)\n\n* python-urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418)\n\nBug Fix(es):\n\n* Satellite upgrade from 6.17.5 to 6.18 failed during Pulpcore database migration due to incompatible versions detected for some of the pulpcore plugins (SAT-41761)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:2764",
        "url": "https://access.redhat.com/errata/RHSA-2026:2764"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2419455",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419455"
      },
      {
        "category": "external",
        "summary": "2419467",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419467"
      },
      {
        "category": "external",
        "summary": "2427726",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427726"
      },
      {
        "category": "external",
        "summary": "SAT-41761",
        "url": "https://issues.redhat.com/browse/SAT-41761"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_2764.json"
      }
    ],
    "title": "Red Hat Security Advisory: Satellite 6.17.6.3 Async Update",
    "tracking": {
      "current_release_date": "2026-10-08T23:34:17+00:00",
      "generator": {
        "date": "2026-10-08T23:34:17+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "5.4.2"
        }
      },
      "id": "RHSA-2026:2764",
      "initial_release_date": "2026-02-16T19:06:28+00:00",
      "revision_history": [
        {
          "date": "2026-02-16T19:06:28+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-02-16T19:06:28+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-10-08T23:34:17+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.17 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.17 for RHEL 9",
                  "product_id": "9Base-satellite-6.17",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite:6.17::el9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.17 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.17 for RHEL 9",
                  "product_id": "9Base-satellite-6.17-capsule",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite_capsule:6.17::el9"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Satellite 6.17 for RHEL 9",
                "product": {
                  "name": "Red Hat Satellite 6.17 for RHEL 9",
                  "product_id": "9Base-satellite-6.17-utils",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:satellite_utils:6.17::el9"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Satellite 6"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "foreman-installer-1:3.14.0.8-1.el9sat.src",
                "product": {
                  "name": "foreman-installer-1:3.14.0.8-1.el9sat.src",
                  "product_id": "foreman-installer-1:3.14.0.8-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-installer@3.14.0.8-1.el9sat?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python-urllib3-0:2.6.3-0.1.el9pc.src",
                "product": {
                  "name": "python-urllib3-0:2.6.3-0.1.el9pc.src",
                  "product_id": "python-urllib3-0:2.6.3-0.1.el9pc.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-urllib3@2.6.3-0.1.el9pc?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-0:6.17.6.3-1.el9sat.src",
                "product": {
                  "name": "satellite-0:6.17.6.3-1.el9sat.src",
                  "product_id": "satellite-0:6.17.6.3-1.el9sat.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite@6.17.6.3-1.el9sat?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "foreman-installer-1:3.14.0.8-1.el9sat.noarch",
                "product": {
                  "name": "foreman-installer-1:3.14.0.8-1.el9sat.noarch",
                  "product_id": "foreman-installer-1:3.14.0.8-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-installer@3.14.0.8-1.el9sat?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
                "product": {
                  "name": "foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
                  "product_id": "foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/foreman-installer-katello@3.14.0.8-1.el9sat?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
                "product": {
                  "name": "python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
                  "product_id": "python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.11-urllib3@2.6.3-0.1.el9pc?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
                "product": {
                  "name": "satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
                  "product_id": "satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-capsule@6.17.6.3-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-common-0:6.17.6.3-1.el9sat.noarch",
                "product": {
                  "name": "satellite-common-0:6.17.6.3-1.el9sat.noarch",
                  "product_id": "satellite-common-0:6.17.6.3-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-common@6.17.6.3-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
                "product": {
                  "name": "satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
                  "product_id": "satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-obsolete-packages@6.17.6.3-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-0:6.17.6.3-1.el9sat.noarch",
                "product": {
                  "name": "satellite-0:6.17.6.3-1.el9sat.noarch",
                  "product_id": "satellite-0:6.17.6.3-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite@6.17.6.3-1.el9sat?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "satellite-cli-0:6.17.6.3-1.el9sat.noarch",
                "product": {
                  "name": "satellite-cli-0:6.17.6.3-1.el9sat.noarch",
                  "product_id": "satellite-cli-0:6.17.6.3-1.el9sat.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/satellite-cli@6.17.6.3-1.el9sat?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-installer-1:3.14.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch"
        },
        "product_reference": "foreman-installer-1:3.14.0.8-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-installer-1:3.14.0.8-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src"
        },
        "product_reference": "foreman-installer-1:3.14.0.8-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch"
        },
        "product_reference": "foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-urllib3-0:2.6.3-0.1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src"
        },
        "product_reference": "python-urllib3-0:2.6.3-0.1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch"
        },
        "product_reference": "python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.17.6.3-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src"
        },
        "product_reference": "satellite-0:6.17.6.3-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-capsule-0:6.17.6.3-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch"
        },
        "product_reference": "satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-common-0:6.17.6.3-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch"
        },
        "product_reference": "satellite-common-0:6.17.6.3-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
        },
        "product_reference": "satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17-capsule"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.17.6.3-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src"
        },
        "product_reference": "satellite-0:6.17.6.3-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17-utils"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-cli-0:6.17.6.3-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch"
        },
        "product_reference": "satellite-cli-0:6.17.6.3-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17-utils"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-installer-1:3.14.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch"
        },
        "product_reference": "foreman-installer-1:3.14.0.8-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-installer-1:3.14.0.8-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src"
        },
        "product_reference": "foreman-installer-1:3.14.0.8-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch"
        },
        "product_reference": "foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-urllib3-0:2.6.3-0.1.el9pc.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src"
        },
        "product_reference": "python-urllib3-0:2.6.3-0.1.el9pc.src",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch"
        },
        "product_reference": "python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.17.6.3-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch"
        },
        "product_reference": "satellite-0:6.17.6.3-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-0:6.17.6.3-1.el9sat.src as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src"
        },
        "product_reference": "satellite-0:6.17.6.3-1.el9sat.src",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-cli-0:6.17.6.3-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch"
        },
        "product_reference": "satellite-cli-0:6.17.6.3-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-common-0:6.17.6.3-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch"
        },
        "product_reference": "satellite-common-0:6.17.6.3-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch as a component of Red Hat Satellite 6.17 for RHEL 9",
          "product_id": "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
        },
        "product_reference": "satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
        "relates_to_product_reference": "9Base-satellite-6.17"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-66418",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-12-05T17:01:20.277857+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2419455"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain causes the client system to consume a virtually unbounded amount of CPU resources and memory. The high resource usage leads to service disruption, making the application unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This Important impact denial of service vulnerability in the urllib3 HTTP client library allows uncontrolled memory consumption when decompressing highly compressed HTTP responses. Due to the lack of an overall decompression size limit in the Streaming API, a malicious server can exhaust client memory, leading to a denial of service.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
          "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
          "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
          "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
          "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
          "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "RHBZ#2419455",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419455"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8",
          "url": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"
        }
      ],
      "release_date": "2025-12-05T16:02:15.271000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-16T19:06:28+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2764"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion"
    },
    {
      "cve": "CVE-2025-66471",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2025-12-05T17:02:21.597728+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2419467"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A decompression handling flaw has been discovered in urllib3. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data; CWE-409) on the client side, even if the application only requested a small chunk of data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3 Streaming API improperly handles highly compressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This is an Important flaw in urllib3\u0027s streaming API that can lead to excessive resource consumption, including high CPU usage and significant memory allocation. When processing highly compressed data from untrusted sources, even small requested chunks can trigger full decompression, posing a denial-of-service risk to client-side applications utilizing affected urllib3 versions prior to 2.6.0.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
          "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
          "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
          "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
          "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
          "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "RHBZ#2419467",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419467"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66471",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7",
          "url": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"
        }
      ],
      "release_date": "2025-12-05T16:06:08.531000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-16T19:06:28+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2764"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data"
    },
    {
      "cve": "CVE-2026-21441",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-01-07T23:01:59.422078+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2427726"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in urllib3. When processing HTTP redirect responses during data streaming, the library automatically reads and decompresses the full response body without enforcing configured size limits. A malicious server can exploit this by serving an excessively compressed response, bypassing decompression bomb safeguards. This issue leads to high memory and processor consumption, resulting in a Denial of Service (DoS) on the client.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
          "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
          "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
          "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch"
        ],
        "known_not_affected": [
          "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
          "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
          "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
          "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
          "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "RHBZ#2427726",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427726"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21441",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b",
          "url": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"
        }
      ],
      "release_date": "2026-01-07T22:09:01.936000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-02-16T19:06:28+00:00",
          "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor detailed instructions how to apply this update, refer to:\n\nhttps://docs.redhat.com/en/documentation/red_hat_satellite/6.17/html/updating_red_hat_satellite/index",
          "product_ids": [
            "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:2764"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17-capsule:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17-capsule:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17-capsule:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-capsule:satellite-capsule-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-capsule:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17-utils:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17-utils:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:foreman-installer-1:3.14.0.8-1.el9sat.src",
            "9Base-satellite-6.17:foreman-installer-katello-1:3.14.0.8-1.el9sat.noarch",
            "9Base-satellite-6.17:python-urllib3-0:2.6.3-0.1.el9pc.src",
            "9Base-satellite-6.17:python3.11-urllib3-0:2.6.3-0.1.el9pc.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-0:6.17.6.3-1.el9sat.src",
            "9Base-satellite-6.17:satellite-cli-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-common-0:6.17.6.3-1.el9sat.noarch",
            "9Base-satellite-6.17:satellite-obsolete-packages-0:6.17.6.3-1.el9sat.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Loading…

Loading…

Loading…

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.


Loading…