Read the docs
TI-2025-36704 Aliases CVE-2025-59089GHSA-hxcg-77v3-qx52

Python-kdcproxy: remote dos via unbounded tcp upstream buffering

Priority LOW 27CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat. Impact type from CWE-770.

Summary

If an attacker causes kdcproxy to connect to an attacker-controlled KDC server (e.g. through server-side request forgery), they can exploit the fact that kdcproxy does not enforce bounds on TCP response length to conduct a denial-of-service attack. While receiving the KDC's response, kdcproxy copies the entire buffered stream into a new buffer on each recv() call, even when the transfer is incomplete, causing excessive memory allocation and CPU usage. Additionally, kdcproxy accepts incoming response chunks as long as the received data length is not exactly equal to the length indicated in the response header, even when individual chunks or the total buffer exceed the maximum length of a Kerberos message. This allows an attacker to send unbounded data until the connection timeout is reached (approximately 12 seconds), exhausting server memory or CPU resources. Multiple concurrent requests can cause accept queue overflow, denying service to legitimate clients.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0056 46th percentileScored 2026-11-07
Fix Fixed kdcproxy (latchset): 1.1.0Red Hat: 13 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
latchsetkdcproxybefore 1.1.01.1.0Patch availableCNA
Red HatRed Hat Enterprise Linux 10—1.0.0-19.el10_1Patch availableCNA
Red HatRed Hat Enterprise Linux 10.0 Extended Update Support—1.0.0-19.el10_0Patch availableCNA
Red HatRed Hat Enterprise Linux 7 Extended Lifecycle Support—0.3.2-3.el7_9.3Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8100020251103113748.143e9e98Patch availableCNA
Red HatRed Hat Enterprise Linux 8—8100020251028161822.823393f5Patch availableCNA
Red HatRed Hat Enterprise Linux 8.2 Advanced Update Support—8020020251106022345.792f4060Patch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support—8040020251103205102.5b01ab7ePatch availableCNA
Red HatRed Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On—8040020251103205102.5b01ab7ePatch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support—8060020251030180424.ada582f1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Telecommunications Update Service—8060020251030180424.ada582f1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.6 Update Services for SAP Solutions—8060020251030180424.ada582f1Patch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Telecommunications Update Service—8080020251029082621.b0a6ceeaPatch availableCNA
Red HatRed Hat Enterprise Linux 8.8 Update Services for SAP Solutions—8080020251029082621.b0a6ceeaPatch availableCNA
Red HatRed Hat Enterprise Linux 9—1.0.0-9.el9_7Patch availableCNA
Red HatRed Hat Enterprise Linux 9.0 Update Services for SAP Solutions—1.0.0-7.el9_0.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.2 Update Services for SAP Solutions—1.0.0-7.el9_2.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.4 Extended Update Support—1.0.0-7.el9_4.1Patch availableCNA
Red HatRed Hat Enterprise Linux 9.6 Extended Update Support—1.0.0-9.el9_6Patch availableCNA
  • kdcproxy Vendorlatchset Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA
  • Red Hat Enterprise Linux 10 VendorRed Hat Affected — Fixed in 1.0.0-19.el10_1 Patch available CNA
  • Red Hat Enterprise Linux 10.0 Extended Update Support VendorRed Hat Affected — Fixed in 1.0.0-19.el10_0 Patch available CNA
  • Red Hat Enterprise Linux 7 Extended Lifecycle Support VendorRed Hat Affected — Fixed in 0.3.2-3.el7_9.3 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020251103113748.143e9e98 Patch available CNA
  • Red Hat Enterprise Linux 8 VendorRed Hat Affected — Fixed in 8100020251028161822.823393f5 Patch available CNA
  • Red Hat Enterprise Linux 8.2 Advanced Update Support VendorRed Hat Affected — Fixed in 8020020251106022345.792f4060 Patch available CNA
  • Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8040020251103205102.5b01ab7e Patch available CNA
  • Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On VendorRed Hat Affected — Fixed in 8040020251103205102.5b01ab7e Patch available CNA
  • Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support VendorRed Hat Affected — Fixed in 8060020251030180424.ada582f1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8060020251030180424.ada582f1 Patch available CNA
  • Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8060020251030180424.ada582f1 Patch available CNA
  • Red Hat Enterprise Linux 8.8 Telecommunications Update Service VendorRed Hat Affected — Fixed in 8080020251029082621.b0a6ceea Patch available CNA
  • Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 8080020251029082621.b0a6ceea Patch available CNA
  • Red Hat Enterprise Linux 9 VendorRed Hat Affected — Fixed in 1.0.0-9.el9_7 Patch available CNA
  • Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.0.0-7.el9_0.1 Patch available CNA
  • Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions VendorRed Hat Affected — Fixed in 1.0.0-7.el9_2.1 Patch available CNA
  • Red Hat Enterprise Linux 9.4 Extended Update Support VendorRed Hat Affected — Fixed in 1.0.0-7.el9_4.1 Patch available CNA
  • Red Hat Enterprise Linux 9.6 Extended Update Support VendorRed Hat Affected — Fixed in 1.0.0-9.el9_6 Patch available CNA

CPE names CNA · 17

CPEVersionsRoleVendor
cpe:/o:redhat:enterprise_linux:10.110.1—Red Hat
cpe:/o:redhat:enterprise_linux_eus:10.010.0—Red Hat
cpe:/o:redhat:rhel_els:77—Red Hat
cpe:/a:redhat:enterprise_linux:8::appstream8—Red Hat
cpe:/a:redhat:rhel_aus:8.2::appstream8.2—Red Hat
cpe:/a:redhat:rhel_aus:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_eus_long_life:8.4::appstream8.4—Red Hat
cpe:/a:redhat:rhel_aus:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_e4s:8.6::appstream8.6—Red Hat
cpe:/a:redhat:rhel_tus:8.6::appstream8.6—Red Hat
  • cpe:/o:redhat:enterprise_linux:10.1 Versions 10.1 — ·Red Hat
  • cpe:/o:redhat:enterprise_linux_eus:10.0 Versions 10.0 — ·Red Hat
  • cpe:/o:redhat:rhel_els:7 Versions 7 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:8::appstream Versions 8 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.2::appstream Versions 8.2 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus_long_life:8.4::appstream Versions 8.4 — ·Red Hat
  • cpe:/a:redhat:rhel_aus:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:8.6::appstream Versions 8.6 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.6::appstream Versions 8.6 — ·Red Hat
Show 7 more CPE
CPEVersionsRoleVendor
cpe:/a:redhat:rhel_e4s:8.8::appstream8.8—Red Hat
cpe:/a:redhat:rhel_tus:8.8::appstream8.8—Red Hat
cpe:/a:redhat:enterprise_linux:9::appstream9—Red Hat
cpe:/a:redhat:rhel_e4s:9.0::appstream9.0—Red Hat
cpe:/a:redhat:rhel_e4s:9.2::appstream9.2—Red Hat
cpe:/a:redhat:rhel_eus:9.4::appstream9.4—Red Hat
cpe:/a:redhat:rhel_eus:9.6::appstream9.6—Red Hat
  • cpe:/a:redhat:rhel_e4s:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:rhel_tus:8.8::appstream Versions 8.8 — ·Red Hat
  • cpe:/a:redhat:enterprise_linux:9::appstream Versions 9 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.0::appstream Versions 9.0 — ·Red Hat
  • cpe:/a:redhat:rhel_e4s:9.2::appstream Versions 9.2 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.4::appstream Versions 9.4 — ·Red Hat
  • cpe:/a:redhat:rhel_eus:9.6::appstream Versions 9.6 — ·Red Hat

Remediation

  • Fix · CNA kdcproxy (latchset) Fixed in 1.1.0

Red Hat 13 advisories

  • RHSA-2025:22982 Released 2025-12-09 · Red Hat rating Important
    python-kdcproxy security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) python-kdcproxy-0.3.2-3.el7_9.3
  • RHSA-2025:21819 Released 2025-11-20 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.aarch64::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.s390x::idm:DL1 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.6.0+21751+4d78cb83.3.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
  • RHSA-2025:21818 Released 2025-11-20 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.x86_64::idm:DL1 +47
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.src::idm:DL1, bind-dyndb-ldap-11.6-4.module+el8.8.0+21675+157fa23b.2.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
Show 10 more Red Hat advisories
  • RHSA-2025:21820 Released 2025-11-20 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.src::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.src::idm:DL1, bind-dyndb-ldap-11.6-2.module+el8.4.0+21736+855b82c8.1.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +39
  • RHSA-2025:21821 Released 2025-11-20 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream AUS (v. 8.2) bind-dyndb-ldap-11.2-3.module+el8.2.0+21753+7109ce90.3.src::idm:DL1, bind-dyndb-ldap-11.2-3.module+el8.2.0+21753+7109ce90.3.x86_64::idm:DL1, custodia-0.6.0-3.module+el8.1.0+4098+f286395e.noarch::idm:DL1 +38
  • RHSA-2025:21806 Released 2025-11-20 · Red Hat rating Important
    python-kdcproxy security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) python-kdcproxy-1.0.0-7.el9_0.1, python3-kdcproxy-1.0.0-7.el9_0.1
  • RHSA-2025:21748 Released 2025-11-19 · Red Hat rating Important
    python-kdcproxy security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python-kdcproxy-1.0.0-7.el9_4.1, python3-kdcproxy-1.0.0-7.el9_4.1
  • RHSA-2025:21448 Released 2025-11-17 · Red Hat rating Important
    python-kdcproxy security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python-kdcproxy-1.0.0-7.el9_2.1, python3-kdcproxy-1.0.0-7.el9_2.1
  • RHSA-2025:21140 Released 2025-11-12 · Red Hat rating Important
    idm:DL1 security update
    • Red Hat Enterprise Linux AppStream (v. 8) bind-dyndb-ldap-11.6-6.module+el8.10.0+23009+91fb337e.aarch64::idm:DL1, bind-dyndb-ldap-11.6-6.module+el8.10.0+23009+91fb337e.ppc64le::idm:DL1, bind-dyndb-ldap-11.6-6.module+el8.10.0+23009+91fb337e.s390x::idm:DL1 +47
  • RHSA-2025:21138 Released 2025-11-12 · Red Hat rating Important
    python-kdcproxy security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python-kdcproxy-1.0.0-9.el9_6, python3-kdcproxy-1.0.0-9.el9_6
  • RHSA-2025:21139 Released 2025-11-12 · Red Hat rating Important
    python-kdcproxy security update
    • Red Hat Enterprise Linux AppStream (v. 9) python-kdcproxy-1.0.0-9.el9_7, python3-kdcproxy-1.0.0-9.el9_7
  • RHSA-2025:21142 Released 2025-11-12 · Red Hat rating Important
    python-kdcproxy security update
    • Red Hat Enterprise Linux AppStream (v. 10) python-kdcproxy-1.0.0-19.el10_1, python3-kdcproxy-1.0.0-19.el10_1
  • RHSA-2025:21141 Released 2025-11-12 · Red Hat rating Important
    python-kdcproxy security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) python-kdcproxy-1.0.0-19.el10_0, python3-kdcproxy-1.0.0-19.el10_0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21138

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21139

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
Show 11 more groups
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21140

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21141

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21142

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21448

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21748

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21806

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21818

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21819

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21820

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:21821

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →
  • Advisory ·

    Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 10.0 Extended Update Support and 16 more products — RHSA-2025:22982

    2 records Highest priority Priority MEDIUM 1 MEDIUM, 1 LOW

    Other records, highest priority first

    • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srvPriority MEDIUM 44
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2025:21142
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2025:21140
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2025:21139
Red Hat Enterprise Linux AppStream AUS (v. 8.2)Fixed RHSA-2025:21821
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2025:21820
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2025:21819
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2025:21819
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2025:21818
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2025:21806
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2025:21448
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2025:21141
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2025:21748
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2025:21138
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2025:21820
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2025:21819
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2025:21818
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2025:22982

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-59089
  2. 2026-10-03 Alias added: GHSA-hxcg-77v3-qx52

References

Advisory 13

Other 4

  • TI-2023-27858 latchset jose through version 11 allows attackers to cause a denial of service (CPU… CVSS 3.1HIGH 7.5
  • TI-2026-28360 JWCrypto: JWE ZIP decompression bomb CVSS 3.1MEDIUM 5.3
  • TI-2024-18683 JWCrypto vulnerable to JWT bomb Attack in `deserialize` function CVSS 3.1MEDIUM 6.8
  • TI-2025-36703 Python-kdcproxy: unauthenticated ssrf via realm‑controlled dns srv CVSS 3.1HIGH 8.6
  • TI-2023-05748 Pkcs11-provider: side-channel proofing pkcs#1 1.5 paths CVSS 3.1HIGH 8.1
  • TI-2016-05392 The _Rsa15 class in the RSA 1.5 algorithm implementation in jwa.py in jwcrypto before… CVSS 3.1MEDIUM 5.3
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences