VDB
RHSA-2026%3A1027
RHSA-2026%3A1027
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in urllib3 Python library that could lead to a Denial of Service condition. A remote, malicious server can exploit this flaw by responding to a client request with an HTTP message that uses an excessive number of chained compression algorithms. This unlimited decompression chain causes the client system to consume a virtually unbounded amount of CPU resources and memory. The high resource usage leads to service disruption, making the application unresponsive.
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9@sha256:5be2edafc6e3ebe96ac46bcd4f5cc9362b81b59dca3b65fd6b39c022c3ca0be1_ppc64le as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9@sha256:5be2edafc6e3ebe96ac46bcd4f5cc9362b81b59dca3b65fd6b39c022c3ca0be1_ppc64le, registry.redhat.io/rhoai/odh-kube-auth-proxy-rhel9@sha256:5be2edafc6e3ebe96ac46bcd4f5cc9362b81b59dca3b65fd6b39c022c3ca0be1_ppc64le, * |
| Red Hat | registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:390ea0ab2dc89aaa93cf0549c8edf9646c740cca914ac74cdca36ff9eabcecb0_ppc64le as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:390ea0ab2dc89aaa93cf0549c8edf9646c740cca914ac74cdca36ff9eabcecb0_ppc64le, registry.redhat.io/rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9@sha256:390ea0ab2dc89aaa93cf0549c8edf9646c740cca914ac74cdca36ff9eabcecb0_ppc64le, * |
| Red Hat | registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9@sha256:4d32581d72709a7ad13c549b92babdcefd7f4aa6d756e3881e99198735fa412f_arm64 as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9@sha256:4d32581d72709a7ad13c549b92babdcefd7f4aa6d756e3881e99198735fa412f_arm64, registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9@sha256:4d32581d72709a7ad13c549b92babdcefd7f4aa6d756e3881e99198735fa412f_arm64, registry.redhat.io/rhoai/odh-mod-arch-model-registry-rhel9@sha256:4d32581d72709a7ad13c549b92babdcefd7f4aa6d756e3881e99198735fa412f_arm64 |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9@sha256:377bfdc0722f7489e23c19decf1b82ac186f1079378d8c349aa60f0094144863_arm64 as a component of Red Hat OpenShift AI 3.2 | *, *, registry.redhat.io/rhoai/odh-trustyai-service-operator-rhel9@sha256:377bfdc0722f7489e23c19decf1b82ac186f1079378d8c349aa60f0094144863_arm64 |
| Red Hat | registry.redhat.io/rhoai/odh-ta-lmes-driver-rhel9@sha256:b1eb46f3c4794dd287e57ca0abd1828cabc9d2cdd40cd32a0b7cbadd3d33f79c_ppc64le as a component of Red Hat OpenShift AI 3.2 | *, registry.redhat.io/rhoai/odh-ta-lmes-driver-rhel9@sha256:b1eb46f3c4794dd287e57ca0abd1828cabc9d2cdd40cd32a0b7cbadd3d33f79c_ppc64le, * |
| Red Hat | registry.redhat.io/rhoai/odh-kserve-agent-rhel9@sha256:407e93e97f0393290dccafa4ae50eabb2ee84f0dfb2cc4daffe2491a97a8b5de_s390x as a component of Red Hat OpenShift AI 3.2 | *, registry.redhat.io/rhoai/odh-kserve-agent-rhel9@sha256:407e93e97f0393290dccafa4ae50eabb2ee84f0dfb2cc4daffe2491a97a8b5de_s390x, * |
| Red Hat | registry.redhat.io/rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9@sha256:669f1711517b5d18568f34623696128485c0b8397c20eb058bf035eedf0e7731_arm64 as a component of Red Hat OpenShift AI 3.2 | *, registry.redhat.io/rhoai/odh-trustyai-vllm-orchestrator-gateway-rhel9@sha256:669f1711517b5d18568f34623696128485c0b8397c20eb058bf035eedf0e7731_arm64, * |
| Red Hat | registry.redhat.io/rhoai/odh-llm-d-routing-sidecar-rhel9@sha256:b5af2775dc25cd62f2fbcbc1167d8a91753a439b3d71890fb690a50b25d3ca83_arm64 as a component of Red Hat OpenShift AI 3.2 | *, *, registry.redhat.io/rhoai/odh-llm-d-routing-sidecar-rhel9@sha256:b5af2775dc25cd62f2fbcbc1167d8a91753a439b3d71890fb690a50b25d3ca83_arm64 |
| Red Hat | registry.redhat.io/rhoai/odh-must-gather-rhel9@sha256:8d7b4125d28df6d52fa12f50fecd561d53735affd0439335cb10b1c8b4ba68f6_s390x as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-must-gather-rhel9@sha256:8d7b4125d28df6d52fa12f50fecd561d53735affd0439335cb10b1c8b4ba68f6_s390x, registry.redhat.io/rhoai/odh-must-gather-rhel9@sha256:8d7b4125d28df6d52fa12f50fecd561d53735affd0439335cb10b1c8b4ba68f6_s390x, registry.redhat.io/rhoai/odh-must-gather-rhel9@sha256:8d7b4125d28df6d52fa12f50fecd561d53735affd0439335cb10b1c8b4ba68f6_s390x |
| Red Hat | registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9@sha256:75df09ffdffa928b88d2c20b9726df857bc7d62903f425cb6c651c8a51025b82_arm64 as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9@sha256:75df09ffdffa928b88d2c20b9726df857bc7d62903f425cb6c651c8a51025b82_arm64, registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9@sha256:75df09ffdffa928b88d2c20b9726df857bc7d62903f425cb6c651c8a51025b82_arm64, registry.redhat.io/rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9@sha256:75df09ffdffa928b88d2c20b9726df857bc7d62903f425cb6c651c8a51025b82_arm64 |
| Red Hat | registry.redhat.io/rhoai/odh-training-operator-rhel9@sha256:5446b127a522e6518f01fe72584c6fb8278e6f1f586061fa3f3e1dc7c7532da8_ppc64le as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-training-operator-rhel9@sha256:5446b127a522e6518f01fe72584c6fb8278e6f1f586061fa3f3e1dc7c7532da8_ppc64le, registry.redhat.io/rhoai/odh-training-operator-rhel9@sha256:5446b127a522e6518f01fe72584c6fb8278e6f1f586061fa3f3e1dc7c7532da8_ppc64le, registry.redhat.io/rhoai/odh-training-operator-rhel9@sha256:5446b127a522e6518f01fe72584c6fb8278e6f1f586061fa3f3e1dc7c7532da8_ppc64le |
| Red Hat | registry.redhat.io/rhoai/odh-ta-lmes-driver-rhel9@sha256:5993c2d168325bc31c13ad174fe62706b79c9d6a1eafa99dda666c5232a130ea_s390x as a component of Red Hat OpenShift AI 3.2 | *, *, registry.redhat.io/rhoai/odh-ta-lmes-driver-rhel9@sha256:5993c2d168325bc31c13ad174fe62706b79c9d6a1eafa99dda666c5232a130ea_s390x |
| Red Hat | registry.redhat.io/rhoai/odh-llama-stack-k8s-operator-rhel9@sha256:d77f2d470a83e2bad0e2e8723bf8d78fe8f38f0bad643724d5c0782bf426c416_arm64 as a component of Red Hat OpenShift AI 3.2 | *, registry.redhat.io/rhoai/odh-llama-stack-k8s-operator-rhel9@sha256:d77f2d470a83e2bad0e2e8723bf8d78fe8f38f0bad643724d5c0782bf426c416_arm64, registry.redhat.io/rhoai/odh-llama-stack-k8s-operator-rhel9@sha256:d77f2d470a83e2bad0e2e8723bf8d78fe8f38f0bad643724d5c0782bf426c416_arm64 |
| Red Hat | registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9@sha256:fb32c4c406c59ddb775b335c6b81f8adef87716213e31fb03a0ef75a1ab2b73b_amd64 as a component of Red Hat OpenShift AI 3.2 | *, registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9@sha256:fb32c4c406c59ddb775b335c6b81f8adef87716213e31fb03a0ef75a1ab2b73b_amd64, registry.redhat.io/rhoai/odh-ml-pipelines-launcher-rhel9@sha256:fb32c4c406c59ddb775b335c6b81f8adef87716213e31fb03a0ef75a1ab2b73b_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-maas-api-rhel9@sha256:79d7b36864e0e17f75485dab74e2e89c2132ce5771abc9ea88c543d764f20a4f_amd64 as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-maas-api-rhel9@sha256:79d7b36864e0e17f75485dab74e2e89c2132ce5771abc9ea88c543d764f20a4f_amd64, registry.redhat.io/rhoai/odh-maas-api-rhel9@sha256:79d7b36864e0e17f75485dab74e2e89c2132ce5771abc9ea88c543d764f20a4f_amd64, registry.redhat.io/rhoai/odh-maas-api-rhel9@sha256:79d7b36864e0e17f75485dab74e2e89c2132ce5771abc9ea88c543d764f20a4f_amd64 |
| Red Hat | registry.redhat.io/rhoai/odh-training-cuda121-torch24-py311-rhel9@sha256:95c23c16f36097a60b15826345a0d3bed14f4f8a170df0114b0a49e32ce6cfed_amd64 as a component of Red Hat OpenShift AI 3.2 | *, registry.redhat.io/rhoai/odh-training-cuda121-torch24-py311-rhel9@sha256:95c23c16f36097a60b15826345a0d3bed14f4f8a170df0114b0a49e32ce6cfed_amd64, * |
| Red Hat | registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:e0f453a8c98ee22adc28b0b156db9d8a1be7a3d96b5a3a7aa2b9c0b4512006c9_ppc64le as a component of Red Hat OpenShift AI 3.2 | *, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9@sha256:e0f453a8c98ee22adc28b0b156db9d8a1be7a3d96b5a3a7aa2b9c0b4512006c9_ppc64le, * |
| Red Hat | registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:6c42f0be9b0996f7788bb37f21daa37c11769383d3cdbef8062b217e638f0607_arm64 as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-kf-notebook-controller-rhel9@sha256:6c42f0be9b0996f7788bb37f21daa37c11769383d3cdbef8062b217e638f0607_arm64, *, * |
| Red Hat | registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:a764cd35505149f18ab79fd0f9b062eeee1584c240fd2f201adb3a8b50a59ffa_ppc64le as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:a764cd35505149f18ab79fd0f9b062eeee1584c240fd2f201adb3a8b50a59ffa_ppc64le, registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:a764cd35505149f18ab79fd0f9b062eeee1584c240fd2f201adb3a8b50a59ffa_ppc64le, registry.redhat.io/rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9@sha256:a764cd35505149f18ab79fd0f9b062eeee1584c240fd2f201adb3a8b50a59ffa_ppc64le |
| Red Hat | registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256:9be2b68d2ef4894b65e2e5ef1969d4e3e6d69d6152b62c329c97244bebb8a8d7_ppc64le as a component of Red Hat OpenShift AI 3.2 | registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256:9be2b68d2ef4894b65e2e5ef1969d4e3e6d69d6152b62c329c97244bebb8a8d7_ppc64le, registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256:9be2b68d2ef4894b65e2e5ef1969d4e3e6d69d6152b62c329c97244bebb8a8d7_ppc64le, registry.redhat.io/rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9@sha256:9be2b68d2ef4894b65e2e5ef1969d4e3e6d69d6152b62c329c97244bebb8a8d7_ppc64le |
…and 423 more
Timeline
- Jan 22, 2026 CVE Published
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Distribution Patch
- Apr 24, 2026 Security Advisory
- Apr 24, 2026 Security Advisory
- Jul 18, 2026 CVE Updated
References
- https://access.redhat.com/errata/RHSA-2026:1027 advisory
- https://access.redhat.com/security/cve/CVE-2025-66418 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_openshift_ai/ advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1027.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2419455 issue
- https://www.cve.org/CVERecord?id=CVE-2025-66418 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2025-66418 advisory
- https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8 advisory
- https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53 advisory