Read the docs
TI-2025-40854 Aliases CVE-2025-66418GHSA-gm62-xv2j-4w53

urllib3 allows an unbounded number of links in the decompression chain

Priority MEDIUM 46CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 96 fixed, 30 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-770.

Summary

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00731 54th percentileScored 2026-11-07
Fix Partial urllib3 (urllib3): 2.6.0urllib3 (PyPI): 2.6.0Red Hat: 113 advisoriesRed Hat: 96 fixed, 30 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
python-pillowurllib31.24 to before 2.6.02.6.0Patch availableCNA
—urllib3 (PyPI)1.24 to before 2.6.02.6.0Patch availableGHSA-gm62-xv2j-4w53
  • urllib3 Vendorpython-pillow Affected 1.24 to before 2.6.0 Fixed in 2.6.0 Patch available CNA
  • urllib3 (PyPI) Vendor— Affected 1.24 to before 2.6.0 Fixed in 2.6.0 Patch available GHSA-gm62-xv2j-4w53

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*1.24 to before 2.6.0Vulnerablepython-pillow
  • cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 1.24 to before 2.6.0 Vulnerable ·python-pillow

Remediation

  • Fix · CNA urllib3 (urllib3) Fixed in 2.6.0
  • Fix · GHSA-gm62-xv2j-4w53 urllib3 (PyPI) Fixed in 2.6.0 Advisory →

Red Hat 113 advisories

  • RHSA-2026:92650 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:73851 Released 2026-10-08 · Red Hat rating Important
    OpenShift Container Platform 4.16.72 bug fix update
    • Red Hat OpenShift Container Platform 4.16 rhcos-aarch64-416.94.202609281908-0, rhcos-ppc64le-416.94.202609281908-0, rhcos-s390x-416.94.202609281908-0 +1
  • RHSA-2026:70615 Released 2026-10-01 · Red Hat rating Important
    OpenShift Container Platform 4.18.56 bug fix and security update
    • Red Hat OpenShift Container Platform 4.18 rhcos-aarch64-418.94.202609171815-0, rhcos-ppc64le-418.94.202609171815-0, rhcos-s390x-418.94.202609171815-0 +1
Show 110 more Red Hat advisories
  • RHSA-2026:70586 Released 2026-10-01 · Red Hat rating Important
    OpenShift Container Platform 4.17.58 bug fix and security update
    • Red Hat OpenShift Container Platform 4.17 rhcos-aarch64-417.94.202609191027-0, rhcos-ppc64le-417.94.202609191027-0, rhcos-s390x-417.94.202609191027-0 +1
  • RHSA-2026:73135 Released 2026-09-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform Execution Environments Update
    • Red Hat Ansible Automation Platform 2.18 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel8
  • RHSA-2026:73134 Released 2026-09-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform Execution Environments Update
    • Red Hat Ansible Automation Platform 2.16 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel9
  • RHSA-2026:73133 Released 2026-09-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform Execution Environments Update
    • Red Hat Ansible Automation Platform 2.16 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel8
  • RHSA-2026:73132 Released 2026-09-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform Execution Environments Update
    • Red Hat Ansible Automation Platform 2.18 registry.redhat.io/ansible-automation-platform/ee-minimal-rhel9
  • RHSA-2026:71210 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8 +4
  • RHSA-2026:71192 Released 2026-09-23 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel9, registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel9
  • RHSA-2026:71179 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +10
  • RHSA-2026:71177 Released 2026-09-23 · Red Hat rating Critical
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/aap-must-gather-rhel9, registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9 +4
  • RHSA-2026:62115 Released 2026-09-01 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:61629 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:61628 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:61627 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:44696 Released 2026-07-23 · Red Hat rating Important
    satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.17 registry.redhat.io/satellite/iop-advisor-engine-rhel9
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:28441 Released 2026-06-23 · Red Hat rating Important
    Red Hat Openshift Mirror Registry v2.0.11
    • mirror registry for Red Hat OpenShift 2.0 registry.redhat.io/openshift/mirror-registry-rhel8
  • RHSA-2026:28043 Released 2026-06-22 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1 (python-urllib3) security update
    • Red Hat OpenStack Platform 17.1 python-urllib3-1.26.5-3.el8ost.3, python3-urllib3-1.26.5-3.el8ost.3
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:14877 Released 2026-05-07 · Red Hat rating Important
    General availability of the satellite/iop-puptoo-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-puptoo-rhel9
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:6292 Released 2026-03-31 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:5807 Released 2026-03-25 · Red Hat rating Important
    RHOAI 2.16.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.16 registry.redhat.io/rhoai/odh-codeflare-operator-rhel8, registry.redhat.io/rhoai/odh-dashboard-rhel8, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel8 +12
  • RHSA-2026:4467 Released 2026-03-12 · Red Hat rating Important
    RHACS 4.9.4 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:4466 Released 2026-03-12 · Red Hat rating Important
    RHACS 4.8.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:4271 Released 2026-03-11 · Red Hat rating Important
    RHTAS 1.3.2 - Tech Preview Release of Model Transparency
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:4215 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.14.6
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4185 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.13.11
    • Red Hat Quay 3.13 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:3874 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.18.4 security update
    • Red Hat OpenShift GitOps 1.18 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3869 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.17.5 security update
    • Red Hat OpenShift GitOps 1.17 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3782 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 2.25.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +27
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:3444 Released 2026-02-26 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:3406 Released 2026-02-26 · Red Hat rating Important
    New container image: rhceph-9.0
    • Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
  • RHSA-2026:3296 Released 2026-02-25 · Red Hat rating Important
    RHTAS - Tech Preview Release Of the Policy Controller Operator
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/policy-controller-rhel9-operator
  • RHSA-2026:2926 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +6
  • RHSA-2026:2925 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:2924 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/client-server-rhel9
  • RHSA-2026:2919 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
  • RHSA-2026:2800 Released 2026-02-17 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2026:2765 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.16.6.1 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 python-urllib3-2.6.3-0.1.el8pc, python3.11-urllib3-2.6.3-0.1.el8pc
    • Red Hat Satellite 6.16 for RHEL 9 python-urllib3-2.6.3-0.1.el9pc, python3.11-urllib3-2.6.3-0.1.el9pc
  • RHSA-2026:2764 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.17.6.3 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 python-urllib3-2.6.3-0.1.el9pc, python3.11-urllib3-2.6.3-0.1.el9pc
  • RHSA-2026:2762 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.10.18
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2754 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.9.18
    • Red Hat Quay 3.9 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2737 Released 2026-02-16 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:2728 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) python-urllib3-1.24.2-4.el8_2.1, python3-urllib3-1.24.2-4.el8_2.1
  • RHSA-2026:2718 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-urllib3-1.24.2-5.el8_8.3, python3-urllib3-1.24.2-5.el8_8.3
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-urllib3-1.24.2-5.el8_8.3, python3-urllib3-1.24.2-5.el8_8.3
  • RHSA-2026:2717 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
  • RHSA-2026:2723 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-urllib3-1.24.2-5.el8_4.1, python3-urllib3-1.24.2-5.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-urllib3-1.24.2-5.el8_4.1, python3-urllib3-1.24.2-5.el8_4.1
  • RHSA-2026:2695 Released 2026-02-12 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 +13
  • RHSA-2026:2681 Released 2026-02-12 · Red Hat rating Important
    Red Hat Quay 3.16.2
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:2563 Released 2026-02-11 · Red Hat rating Important
    Red Hat Update Infrastructure 5 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:2500 Released 2026-02-11 · Red Hat rating Important
    Red Hat multicluster global hub 1.4.4 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:2456 Released 2026-02-10 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.26.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:2279 Released 2026-02-09 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.24, fence-agents-all-4.2.1-65.el8_4.24, fence-agents-amt-ws-4.2.1-65.el8_4.24 +39
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) fence-agents-4.2.1-65.el8_4.24, fence-agents-all-4.2.1-65.el8_4.24, fence-agents-amt-ws-4.2.1-65.el8_4.24 +36
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.24, fence-agents-aws-4.2.1-65.el8_4.24, fence-agents-azure-arm-4.2.1-65.el8_4.24 +1
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.24, fence-agents-aws-4.2.1-65.el8_4.24, fence-agents-azure-arm-4.2.1-65.el8_4.24 +1
  • RHSA-2026:2256 Released 2026-02-09 · Red Hat rating Important
    Red Hat multicluster global hub 1.5.3 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:2144 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +7
  • RHSA-2026:2139 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:2137 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/client-server-rhel9
  • RHSA-2026:2126 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9
  • RHSA-2026:2106 Released 2026-02-05 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:1957 Released 2026-02-04 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.12-urllib3-1.26.18-2.el9_4.2
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1736 Released 2026-02-02 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:1730 Released 2026-02-02 · Red Hat rating Important
    Red Hat Quay 3.12.13
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1729 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) python-urllib3-1.26.5-6.el9_6.1, python3-urllib3-1.26.5-6.el9_6.1
  • RHSA-2026:1726 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python-urllib3-1.26.19-2.el10_0.1, python3-urllib3-1.26.19-2.el10_0.1
  • RHSA-2026:1712 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.11-urllib3-1.26.12-2.el9_4.3
  • RHSA-2026:1704 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.11-urllib3-1.26.12-5.el9_6.1
  • RHSA-2026:1702 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents-4.2.1-89.el8_6.19, fence-agents-all-4.2.1-89.el8_6.19, fence-agents-amt-ws-4.2.1-89.el8_6.19 +40
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) fence-agents-4.2.1-89.el8_6.19, fence-agents-all-4.2.1-89.el8_6.19, fence-agents-amt-ws-4.2.1-89.el8_6.19 +41
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) fence-agents-4.2.1-89.el8_6.19, fence-agents-all-4.2.1-89.el8_6.19, fence-agents-amt-ws-4.2.1-89.el8_6.19 +40
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.19, fence-agents-aws-4.2.1-89.el8_6.19, fence-agents-azure-arm-4.2.1-89.el8_6.19 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.19, fence-agents-aws-4.2.1-89.el8_6.19, fence-agents-azure-arm-4.2.1-89.el8_6.19 +1
  • RHSA-2026:1701 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) fence-agents-4.2.1-112.el8_8.14, fence-agents-all-4.2.1-112.el8_8.14, fence-agents-amt-ws-4.2.1-112.el8_8.14 +40
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) fence-agents-4.2.1-112.el8_8.14, fence-agents-all-4.2.1-112.el8_8.14, fence-agents-amt-ws-4.2.1-112.el8_8.14 +39
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.14, fence-agents-aws-4.2.1-112.el8_8.14, fence-agents-azure-arm-4.2.1-112.el8_8.14 +2
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.14, fence-agents-aws-4.2.1-112.el8_8.14, fence-agents-azure-arm-4.2.1-112.el8_8.14 +2
  • RHSA-2026:1693 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-urllib3-1.26.5-3.el9_2.3, python3-urllib3-1.26.5-3.el9_2.3
  • RHSA-2026:1676 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) python3.11-urllib3-1.26.12-1.el8_8.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) python3.11-urllib3-1.26.12-1.el8_8.3
  • RHSA-2026:1674 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) python-urllib3-1.26.5-5.el9_4.3, python3-urllib3-1.26.5-5.el9_4.3
  • RHSA-2026:1652 Released 2026-02-02 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:1619 Released 2026-02-02 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.12-urllib3-1.26.19-1.el9_6.1
  • RHSA-2026:1618 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) python-urllib3-1.26.5-3.el9_0.2, python3-urllib3-1.26.5-3.el9_0.2
  • RHSA-2026:1546 Released 2026-01-29 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python3.11-urllib3-1.26.12-1.el9_2.2
  • RHSA-2026:1504 Released 2026-01-28 · Red Hat rating Important
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:1485 Released 2026-01-28 · Red Hat rating Important
    RHUI 4.11.3 security update - python-urllib3
    • RHUI 4 for RHEL 8 python-urllib3-2.6.3-1.el8ui, python3.11-urllib3-2.6.3-1.el8ui
  • RHSA-2026:1338 Released 2026-01-27 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents-4.1.1-90.el8_4.21, resource-agents-aliyun-4.1.1-90.el8_4.21, resource-agents-gcp-4.1.1-90.el8_4.21
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) resource-agents-4.1.1-90.el8_4.21, resource-agents-aliyun-4.1.1-90.el8_4.21, resource-agents-gcp-4.1.1-90.el8_4.21
  • RHSA-2026:1340 Released 2026-01-27 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) resource-agents-4.9.0-16.el8_6.18, resource-agents-aliyun-4.9.0-16.el8_6.18, resource-agents-gcp-4.9.0-16.el8_6.18 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) resource-agents-4.9.0-16.el8_6.18, resource-agents-aliyun-4.9.0-16.el8_6.18, resource-agents-gcp-4.9.0-16.el8_6.18 +1
  • RHSA-2026:1339 Released 2026-01-27 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) resource-agents-4.9.0-40.el8_8.14, resource-agents-aliyun-4.9.0-40.el8_8.14, resource-agents-gcp-4.9.0-40.el8_8.14 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) resource-agents-4.9.0-40.el8_8.14, resource-agents-aliyun-4.9.0-40.el8_8.14, resource-agents-gcp-4.9.0-40.el8_8.14 +1
  • RHSA-2026:1336 Released 2026-01-27 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) resource-agents-4.1.1-61.el7_9.21, resource-agents-aliyun-4.1.1-61.el7_9.21, resource-agents-gcp-4.1.1-61.el7_9.21
    • Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) resource-agents-4.1.1-61.el7_9.21, resource-agents-aliyun-4.1.1-61.el7_9.21, resource-agents-gcp-4.1.1-61.el7_9.21
    • Red Hat Enterprise Linux Server for SAP ELS (v. 7) resource-agents-4.1.1-61.el7_9.21, resource-agents-sap-4.1.1-61.el7_9.21, sap-cluster-connector-3.0.1-37.el7_9.21
    • Red Hat Enterprise Linux Server for SAPHANA ELS (v. 7) resource-agents-4.1.1-61.el7_9.21, resource-agents-sap-hana-4.1.1-61.el7_9.21, resource-agents-sap-hana-scaleout-0.164.0-6.el7_9.21
  • RHSA-2026:1337 Released 2026-01-27 · Red Hat rating Important
    python-s3transfer security update
    • Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) python-s3transfer-0.1.13-1.el7_9.3
    • Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) python-s3transfer-0.1.13-1.el7_9.3
  • RHSA-2026:1332 Released 2026-01-27 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.13, fence-agents-aliyun-4.10.0-86.el9_6.13, fence-agents-all-4.10.0-86.el9_6.13 +47
  • RHSA-2026:1331 Released 2026-01-27 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) fence-agents-4.10.0-62.el9_4.20, fence-agents-common-4.10.0-62.el9_4.20, fence-agents-compute-4.10.0-62.el9_4.20 +11
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.20, fence-agents-all-4.10.0-62.el9_4.20, fence-agents-amt-ws-4.10.0-62.el9_4.20 +40
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.20, fence-agents-all-4.10.0-62.el9_4.20, fence-agents-amt-ws-4.10.0-62.el9_4.20 +39
  • RHSA-2026:1329 Released 2026-01-27 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) fence-agents-4.10.0-20.el9_0.26, fence-agents-common-4.10.0-20.el9_0.26, fence-agents-compute-4.10.0-20.el9_0.26 +12
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.26, fence-agents-all-4.10.0-20.el9_0.26, fence-agents-amt-ws-4.10.0-20.el9_0.26 +40
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.26, fence-agents-all-4.10.0-20.el9_0.26, fence-agents-amt-ws-4.10.0-20.el9_0.26 +39
  • RHSA-2026:1330 Released 2026-01-27 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.17, fence-agents-common-4.10.0-43.el9_2.17, fence-agents-compute-4.10.0-43.el9_2.17 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.17, fence-agents-all-4.10.0-43.el9_2.17, fence-agents-amt-ws-4.10.0-43.el9_2.17 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.17, fence-agents-all-4.10.0-43.el9_2.17, fence-agents-amt-ws-4.10.0-43.el9_2.17 +39
  • RHSA-2026:1254 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) python-urllib3-1.24.2-9.el8_10, python3-urllib3-1.24.2-9.el8_10
  • RHSA-2026:1240 Released 2026-01-26 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.20, fence-agents-all-4.2.1-129.el8_10.20, fence-agents-amt-ws-4.2.1-129.el8_10.20 +41
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.20, fence-agents-aws-4.2.1-129.el8_10.20, fence-agents-azure-arm-4.2.1-129.el8_10.20 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.20, fence-agents-aws-4.2.1-129.el8_10.20, fence-agents-azure-arm-4.2.1-129.el8_10.20 +2
  • RHSA-2026:1239 Released 2026-01-26 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-98.el9_7.4, fence-agents-aliyun-4.10.0-98.el9_7.4, fence-agents-all-4.10.0-98.el9_7.4 +47
  • RHSA-2026:1241 Released 2026-01-26 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) resource-agents-4.9.0-54.el8_10.27, resource-agents-aliyun-4.9.0-54.el8_10.27, resource-agents-gcp-4.9.0-54.el8_10.27 +1
    • Red Hat Enterprise Linux ResilientStorage (v. 8) resource-agents-4.9.0-54.el8_10.27, resource-agents-aliyun-4.9.0-54.el8_10.27, resource-agents-gcp-4.9.0-54.el8_10.27 +1
  • RHSA-2026:1226 Released 2026-01-26 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-urllib3-1.26.19-2.el8_10
  • RHSA-2026:1224 Released 2026-01-26 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.11-urllib3-1.26.12-6.el8_10
  • RHSA-2026:1088 Released 2026-01-26 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-urllib3-1.26.19-1.el9_7.1
  • RHSA-2026:1089 Released 2026-01-26 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-urllib3-1.26.12-5.el9_7.1
  • RHSA-2026:1087 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3-1.26.5-6.el9_7.1, python3-urllib3-1.26.5-6.el9_7.1
  • RHSA-2026:1086 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 10) python-urllib3-1.26.19-2.el10_1.1, python3-urllib3-1.26.19-2.el10_1.1
  • RHSA-2026:1176 Released 2026-01-26 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:1168 Released 2026-01-26 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:1042 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:1041 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:1027 Released 2026-01-22 · Red Hat rating Important
    RHOAI 3.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9, registry.redhat.io/rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 +10
  • RHSA-2026:1026 Released 2026-01-22 · Red Hat rating Important
    RHOAI 3.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.2 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-guardrails-detector-huggingface-runtime-rhel9
  • RHSA-2026:0990 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:0414 Released 2026-01-08 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:0050 Released 2026-01-05 · Red Hat rating Important
    Red Hat OpenShift Builds 1.6.2
    • Builds for Red Hat OpenShift 1.6.0 registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9, registry.redhat.io/openshift-builds/openshift-builds-shared-resource-webhook-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Assisted Installer for Red Hat OpenShift Container Platform 2AffectedNo fix planned: Will not fix
Confidential Compute AttestationAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for ContainersAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix yet
Multiarch Tuning OperatorAffectedNo fix yet
Multicluster Engine for KubernetesAffectedNo fix planned: Will not fix
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix yet
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat Edge Manager previewAffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI)AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Quarkus Native builderAffectedNo fix yet
cert-manager Operator for Red Hat OpenShiftAffectedNo fix yet
Builds for Red Hat OpenShift 1.6.0Fixed RHSA-2026:0050
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:0990, RHSA-2026:1041, RHSA-2026:1042, RHSA-2026:1168, RHSA-2026:1176
Multicluster Global Hub 1.4.9Fixed RHSA-2026:2500
Multicluster Global Hub 1.5.8Fixed RHSA-2026:2256
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
OpenShift API for Data Protection 1.3Fixed RHSA-2026:3444
RHUI 4 for RHEL 8Fixed RHSA-2026:1485
Red Hat AI Inference Server 3.2Fixed RHSA-2026:3461, RHSA-2026:3462, RHSA-2026:61627, RHSA-2026:61628, RHSA-2026:61629
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:4466
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:4467
Red Hat Ansible Automation Platform 2.16Fixed RHSA-2026:73133, RHSA-2026:73134
Red Hat Ansible Automation Platform 2.18Fixed RHSA-2026:73132, RHSA-2026:73135
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:71192, RHSA-2026:71210
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:71179
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:71177
Red Hat Ceph Storage 7Fixed RHSA-2026:2800
Red Hat Ceph Storage 8Fixed RHSA-2026:1652, RHSA-2026:2737
Red Hat Ceph Storage 8.1Fixed RHSA-2026:62115
Red Hat Ceph Storage 9Fixed RHSA-2026:3406
Red Hat Discovery 2Fixed RHSA-2026:0414, RHSA-2026:1736
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:1224, RHSA-2026:1226, RHSA-2026:1240
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:1088, RHSA-2026:1089, RHSA-2026:1239
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:2279
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:1702
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:1702
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:1676, RHSA-2026:1701
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:1329
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:1330, RHSA-2026:1546
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:1331, RHSA-2026:1712, RHSA-2026:1957
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:1332, RHSA-2026:1619, RHSA-2026:1704
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:2279
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:1702
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:1676, RHSA-2026:1701
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:1086
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:1254
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:1087
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:2728
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:2723
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:2718
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:1618
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:1693
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:1726
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:1674
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:1729
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:2723
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:2718
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:1338, RHSA-2026:2279
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2026:1340, RHSA-2026:1702
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:1339, RHSA-2026:1701
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2026:1329
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:1330
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2026:1331
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2026:1340, RHSA-2026:1702
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:1339, RHSA-2026:1701
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:1240, RHSA-2026:1241
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:1338, RHSA-2026:2279
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:1330
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2026:1331
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:1240, RHSA-2026:1241
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2026:1329
Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS)Fixed RHSA-2026:1336, RHSA-2026:1337
Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS)Fixed RHSA-2026:1336, RHSA-2026:1337
Red Hat Enterprise Linux Server for SAP ELS (v. 7)Fixed RHSA-2026:1336
Red Hat Enterprise Linux Server for SAPHANA ELS (v. 7)Fixed RHSA-2026:1336
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.16Fixed RHSA-2026:5807
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184, RHSA-2026:2106, RHSA-2026:2695, RHSA-2026:3782
Red Hat OpenShift AI 3.2Fixed RHSA-2026:1027
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712, RHSA-2026:3713
Red Hat OpenShift Container Platform 4.16Fixed RHSA-2026:73851
Red Hat OpenShift Container Platform 4.17Fixed RHSA-2026:70586
Red Hat OpenShift Container Platform 4.18Fixed RHSA-2026:70615
Red Hat OpenShift Dev Spaces (RHOSDS) 3.26Fixed RHSA-2026:2456
Red Hat OpenShift GitOps 1.17Fixed RHSA-2026:3869
Red Hat OpenShift GitOps 1.18Fixed RHSA-2026:3874
Red Hat OpenStack Platform 17.1Fixed RHSA-2026:28043
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:92650
Red Hat Quay 3.10Fixed RHSA-2026:2762
Red Hat Quay 3.12Fixed RHSA-2026:1730
Red Hat Quay 3.13Fixed RHSA-2026:4185
Red Hat Quay 3.14Fixed RHSA-2026:4215
Red Hat Quay 3.15Fixed RHSA-2026:1942
Red Hat Quay 3.16Fixed RHSA-2026:2681
Red Hat Quay 3.9Fixed RHSA-2026:2754
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:2765
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:2765
Red Hat Satellite 6.17Fixed RHSA-2026:44696
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:2764
Red Hat Satellite 6.18Fixed RHSA-2026:14877, RHSA-2026:1504, RHSA-2026:6292
Red Hat Trusted Artifact Signer 1.2Fixed RHSA-2026:2919, RHSA-2026:2924, RHSA-2026:2925, RHSA-2026:2926
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:2126, RHSA-2026:2137, RHSA-2026:2139, RHSA-2026:2144, RHSA-2026:3296, RHSA-2026:4271
Red Hat Update Infrastructure 5Fixed RHSA-2026:2563
mirror registry for Red Hat OpenShift 2.0Fixed RHSA-2026:28441
Not affected: 72 products
  • Assisted Installer for Red Hat OpenShift Container Platform 2
  • Builds for Red Hat OpenShift 1.6.0
  • Cert Manager support for Red Hat OpenShift release 1.18
  • Confidential Compute Attestation
  • Dynamic Accelerator Slicer Operator for Red Hat OpenShift
  • External Secrets Operator for Red Hat OpenShift
  • Fence Agents Remediation Operator
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift API for Data Protection
  • OpenShift API for Data Protection 1.3
  • OpenShift Lightspeed
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Ansible Automation Platform Ansible Core 2
  • Red Hat Ceph Storage 7
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 8.1
  • Red Hat Ceph Storage 9
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Migration Toolkit 1.8
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.16
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.2
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat OpenShift GitOps 1.17
  • Red Hat OpenShift GitOps 1.18
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Quay 3
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.13
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Quay 3.9
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Trusted Artifact Signer 1.2
  • Red Hat Trusted Artifact Signer 1.3
  • Self Node Remediation Operator
  • Service Telemetry Framework 1.5
  • Zero Trust Workload Identity Manager - Tech Preview
  • external secrets operator for Red Hat OpenShift - Tech Preview

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66418
  2. 2026-10-03 Alias added: GHSA-gm62-xv2j-4w53
  3. 2026-10-09 Fix available: RHSA-2026:73851 · Red Hat
  4. 2026-10-09 Fix available: Red Hat OpenShift Container Platform 4.16 · Red Hat
  5. 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat
  6. 2026-10-27 Affected versions changed · Red Hat
  7. 2026-10-30 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
  8. 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat
  9. 2026-11-06 Fix available: RHSA-2026:2717 · Red Hat
  10. 2026-11-06 Fix available: RHSA-2026:2728 · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:71177 · Red Hat
  12. 2026-11-06 Fix available: RHSA-2026:2919 · Red Hat
  13. 2026-11-06 Fix available: RHSA-2026:73134 · Red Hat

References

Patch 1

Advisory 2

Other 1

  • TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
  • TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
  • TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
  • TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
  • TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
  • TI-2020-05823 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through… CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences