Read the docs
TI-2025-40898 Aliases CVE-2025-66471GHSA-2xpw-w6gg-jr37

urllib3 Streaming API improperly handles highly compressed data

Priority MEDIUM 40CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 98 fixed, 28 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00731 54th percentileScored 2026-11-07
Fix Partial urllib3 (urllib3): 2.6.0urllib3 (PyPI): 2.6.0Red Hat: 115 advisoriesRed Hat: 98 fixed, 28 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
python-pillowurllib31.0 to before 2.6.02.6.0Patch availableCNA
—urllib3 (PyPI)1.0 to before 2.6.02.6.0Patch availableGHSA-2xpw-w6gg-jr37
  • urllib3 Vendorpython-pillow Affected 1.0 to before 2.6.0 Fixed in 2.6.0 Patch available CNA
  • urllib3 (PyPI) Vendor— Affected 1.0 to before 2.6.0 Fixed in 2.6.0 Patch available GHSA-2xpw-w6gg-jr37

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*1.0 to before 2.6.0Vulnerablepython-pillow
  • cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 1.0 to before 2.6.0 Vulnerable ·python-pillow

Remediation

  • Fix · CNA urllib3 (urllib3) Fixed in 2.6.0
  • Fix · GHSA-2xpw-w6gg-jr37 urllib3 (PyPI) Fixed in 2.6.0 Advisory →

Red Hat 115 advisories

  • RHSA-2026:92650 Released 2026-10-29 · Red Hat rating Important
    Red Hat OpenShift Data Foundation 4.19.26 security, enhancement & bug fix update
    • Red Hat Openshift Data Foundation 4.19 registry.redhat.io/odf4/cephcsi-rhel9, registry.redhat.io/odf4/cephcsi-rhel9-operator, registry.redhat.io/odf4/mcg-core-rhel9 +17
  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:73987 Released 2026-09-30 · Red Hat rating Critical
    RHOAI 3.3.7 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
Show 112 more Red Hat advisories
  • RHSA-2026:61628 Released 2026-08-31 · Red Hat rating Important
    Red Hat AI Inference Server Model Optimization Tools 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/model-opt-cuda-rhel9
  • RHSA-2026:60520 Released 2026-08-27 · Red Hat rating Critical
    RHOAI 3.4.4 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9, registry.redhat.io/rhoai/odh-built-in-detector-rhel9 +47
  • RHSA-2026:51357 Released 2026-08-06 · Red Hat rating Important
    satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-vulnerability-engine-rhel9
  • RHSA-2026:44696 Released 2026-07-23 · Red Hat rating Important
    satellite/iop-advisor-engine-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.17 registry.redhat.io/satellite/iop-advisor-engine-rhel9
  • RHSA-2026:41928 Released 2026-07-20 · Red Hat rating Important
    Red Hat Migration Toolkit for Containers
    • Red Hat Migration Toolkit 1.8 registry.redhat.io/rhmtc/openshift-migration-controller-rhel8, registry.redhat.io/rhmtc/openshift-migration-hook-runner-rhel8, registry.redhat.io/rhmtc/openshift-migration-log-reader-rhel8 +6
  • RHSA-2026:34527 Released 2026-07-01 · Red Hat rating Important
    General availability of the satellite/iop-host-inventory-frontend-rhel9 container image
    • Red Hat Satellite 6.19 registry.redhat.io/satellite/iop-host-inventory-frontend-rhel9
  • RHSA-2026:28441 Released 2026-06-23 · Red Hat rating Important
    Red Hat Openshift Mirror Registry v2.0.11
    • mirror registry for Red Hat OpenShift 2.0 registry.redhat.io/openshift/mirror-registry-rhel8
  • RHSA-2026:28043 Released 2026-06-22 · Red Hat rating Important
    Red Hat OpenStack Platform 17.1 (python-urllib3) security update
    • Red Hat OpenStack Platform 17.1 python-urllib3-1.26.5-3.el8ost.3, python3-urllib3-1.26.5-3.el8ost.3
  • RHSA-2026:19712 Released 2026-05-20 · Red Hat rating Critical
    RHOAI 3.3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +33
  • RHSA-2026:14877 Released 2026-05-07 · Red Hat rating Important
    General availability of the satellite/iop-puptoo-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-puptoo-rhel9
  • RHSA-2026:11722 Released 2026-04-29 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION) python-urllib3-1.10.2-3.el6_10.1
  • RHSA-2026:10184 Released 2026-04-23 · Red Hat rating Important
    RHOAI 2.25.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:9031 Released 2026-04-20 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux Server (v. 7 ELS) python-urllib3-1.10.2-7.el7_9.1
  • RHSA-2026:6292 Released 2026-03-31 · Red Hat rating Important
    General availability of the satellite/iop-insights-engine-rhel9 container image
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/iop-insights-engine-rhel9
  • RHSA-2026:6055 Released 2026-03-30 · Red Hat rating Important
    Red Hat OpenShift Builds 1.7.1
    • Red Hat OpenShift Builds 1.7.3 registry.redhat.io/openshift-builds/openshift-builds-shared-resource-rhel9
  • RHSA-2026:5549 Released 2026-03-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.6.4
    • Builds for Red Hat OpenShift 1.6.0 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel9, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel9, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel9 +6
  • RHSA-2026:5459 Released 2026-03-23 · Red Hat rating Important
    RHTAS 1.3.3 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9
  • RHSA-2026:4467 Released 2026-03-12 · Red Hat rating Important
    RHACS 4.9.4 security and bug fix update
    • Red Hat Advanced Cluster Security 4.9 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:4466 Released 2026-03-12 · Red Hat rating Important
    RHACS 4.8.9 security and bug fix update
    • Red Hat Advanced Cluster Security 4.8 registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel8, registry.redhat.io/advanced-cluster-security/rhacs-main-rhel8 +8
  • RHSA-2026:4271 Released 2026-03-11 · Red Hat rating Important
    RHTAS 1.3.2 - Tech Preview Release of Model Transparency
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/model-transparency-rhel9
  • RHSA-2026:4215 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.14.6
    • Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:4185 Released 2026-03-10 · Red Hat rating Important
    Red Hat Quay 3.13.11
    • Red Hat Quay 3.13 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:3960 Released 2026-03-06 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9, registry.redhat.io/ansible-automation-platform-26/ee-minimal-rhel9 +9
  • RHSA-2026:3874 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.18.4 security update
    • Red Hat OpenShift GitOps 1.18 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3869 Released 2026-03-05 · Red Hat rating Important
    Red Hat OpenShift GitOps v1.17.5 security update
    • Red Hat OpenShift GitOps 1.17 registry.redhat.io/openshift-gitops-1/argo-rollouts-rhel8, registry.redhat.io/openshift-gitops-1/argocd-agent-rhel8, registry.redhat.io/openshift-gitops-1/argocd-rhel8 +6
  • RHSA-2026:3782 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 2.25.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-codeflare-operator-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +27
  • RHSA-2026:3713 Released 2026-03-04 · Red Hat rating Critical
    RHOAI 3.3 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.3 registry.redhat.io/rhoai/odh-built-in-detector-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9 +47
  • RHSA-2026:3462 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (ROCm)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-rocm-rhel9
  • RHSA-2026:3461 Released 2026-02-27 · Red Hat rating Critical
    Red Hat AI Inference Server 3.2.2 (CUDA)
    • Red Hat AI Inference Server 3.2 registry.redhat.io/rhaiis/vllm-cuda-rhel9
  • RHSA-2026:3444 Released 2026-02-26 · Red Hat rating Important
    Red Hat OpenShift API for Data Protection
    • OpenShift API for Data Protection 1.3 registry.redhat.io/oadp/oadp-kubevirt-velero-plugin-rhel9, registry.redhat.io/oadp/oadp-mustgather-rhel9, registry.redhat.io/oadp/oadp-rhel9-operator +7
  • RHSA-2026:3406 Released 2026-02-26 · Red Hat rating Important
    New container image: rhceph-9.0
    • Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
  • RHSA-2026:3296 Released 2026-02-25 · Red Hat rating Important
    RHTAS - Tech Preview Release Of the Policy Controller Operator
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/policy-controller-rhel9-operator
  • RHSA-2026:2926 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9, registry.redhat.io/rhtas/rekor-search-ui-rhel9 +6
  • RHSA-2026:2925 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:2924 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/client-server-rhel9
  • RHSA-2026:2919 Released 2026-02-18 · Red Hat rating Important
    RHTAS 1.2.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.2 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9
  • RHSA-2026:2900 Released 2026-02-18 · Red Hat rating Important
    Network Observability 1.11.0 for OpenShift
    • Network Observability (NETOBSERV) 1.11.0 registry.redhat.io/network-observability/network-observability-cli-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-compat-rhel9, registry.redhat.io/network-observability/network-observability-console-plugin-rhel9 +2
  • RHSA-2026:2800 Released 2026-02-17 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 7 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
  • RHSA-2026:2765 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.16.6.1 Async Update
    • Red Hat Satellite 6.16 for RHEL 8 python-urllib3-2.6.3-0.1.el8pc, python3.11-urllib3-2.6.3-0.1.el8pc
    • Red Hat Satellite 6.16 for RHEL 9 python-urllib3-2.6.3-0.1.el9pc, python3.11-urllib3-2.6.3-0.1.el9pc
  • RHSA-2026:2764 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.17.6.3 Async Update
    • Red Hat Satellite 6.17 for RHEL 9 python-urllib3-2.6.3-0.1.el9pc, python3.11-urllib3-2.6.3-0.1.el9pc
  • RHSA-2026:2762 Released 2026-02-16 · Red Hat rating Important
    Red Hat Quay 3.10.18
    • Red Hat Quay 3.10 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:2760 Released 2026-02-16 · Red Hat rating Important
    Satellite 6.18.3 Async Update
    • Red Hat Satellite 6.18 for RHEL 9 python3.12-aiohttp-3.13.3-1.el9pc, python3.12-urllib3-2.6.3-1.el9pc
  • RHSA-2026:2737 Released 2026-02-16 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:2728 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) python-urllib3-1.24.2-4.el8_2.1, python3-urllib3-1.24.2-4.el8_2.1
  • RHSA-2026:2718 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-urllib3-1.24.2-5.el8_8.3, python3-urllib3-1.24.2-5.el8_8.3
    • Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-urllib3-1.24.2-5.el8_8.3, python3-urllib3-1.24.2-5.el8_8.3
  • RHSA-2026:2717 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
    • Red Hat Enterprise Linux BaseOS E4S (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
    • Red Hat Enterprise Linux BaseOS TUS (v.8.6) python-urllib3-1.24.2-5.el8_6.4, python3-urllib3-1.24.2-5.el8_6.4
  • RHSA-2026:2723 Released 2026-02-16 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-urllib3-1.24.2-5.el8_4.1, python3-urllib3-1.24.2-5.el8_4.1
    • Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-urllib3-1.24.2-5.el8_4.1, python3-urllib3-1.24.2-5.el8_4.1
  • RHSA-2026:2695 Released 2026-02-12 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-dashboard-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-argoexec-rhel9, registry.redhat.io/rhoai/odh-data-science-pipelines-argo-workflowcontroller-rhel9 +13
  • RHSA-2026:2681 Released 2026-02-12 · Red Hat rating Important
    Red Hat Quay 3.16.2
    • Red Hat Quay 3.16 registry.redhat.io/quay/quay-builder-rhel9, registry.redhat.io/quay/quay-rhel9
  • RHSA-2026:2563 Released 2026-02-11 · Red Hat rating Important
    Red Hat Update Infrastructure 5 security update
    • Red Hat Update Infrastructure 5 registry.redhat.io/rhui5/cds-rhel9, registry.redhat.io/rhui5/haproxy-rhel9, registry.redhat.io/rhui5/installer-rhel9 +1
  • RHSA-2026:2500 Released 2026-02-11 · Red Hat rating Important
    Red Hat multicluster global hub 1.4.4 security update
    • Multicluster Global Hub 1.4.9 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:2456 Released 2026-02-10 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.26.0 Release.
    • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +9
  • RHSA-2026:2256 Released 2026-02-09 · Red Hat rating Important
    Red Hat multicluster global hub 1.5.3 security update
    • Multicluster Global Hub 1.5.8 registry.redhat.io/multicluster-globalhub/multicluster-globalhub-grafana-rhel9
  • RHSA-2026:2144 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/certificate-transparency-rhel9, registry.redhat.io/rhtas/fulcio-rhel9, registry.redhat.io/rhtas/rekor-backfill-redis-rhel9 +7
  • RHSA-2026:2139 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/segment-reporting-rhel9
  • RHSA-2026:2137 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/client-server-rhel9
  • RHSA-2026:2126 Released 2026-02-05 · Red Hat rating Important
    RHTAS 1.3.2 - Red Hat Trusted Artifact Signer Release
    • Red Hat Trusted Artifact Signer 1.3 registry.redhat.io/rhtas/tuffer-rhel9, registry.redhat.io/rhtas/tuftool-rhel9
  • RHSA-2026:2106 Released 2026-02-05 · Red Hat rating Important
    RHOAI 2.25.2 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 2.25 registry.redhat.io/rhoai/odh-caikit-nlp-rhel9, registry.redhat.io/rhoai/odh-caikit-tgis-serving-rhel9, registry.redhat.io/rhoai/odh-dashboard-rhel9 +47
  • RHSA-2026:2060 Released 2026-02-05 · Red Hat rating Important
    python-s3transfer security update
    • Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) python-s3transfer-0.1.13-1.el7_9.5
    • Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) python-s3transfer-0.1.13-1.el7_9.5
  • RHSA-2026:1957 Released 2026-02-04 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.12-urllib3-1.26.18-2.el9_4.2
  • RHSA-2026:1942 Released 2026-02-04 · Red Hat rating Important
    Red Hat Quay 3.15.3
    • Red Hat Quay 3.15 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1805 Released 2026-02-03 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) resource-agents-4.1.1-90.el8_4.22, resource-agents-aliyun-4.1.1-90.el8_4.22, resource-agents-gcp-4.1.1-90.el8_4.22
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) resource-agents-4.1.1-90.el8_4.22, resource-agents-aliyun-4.1.1-90.el8_4.22, resource-agents-gcp-4.1.1-90.el8_4.22
  • RHSA-2026:1803 Released 2026-02-03 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.25, fence-agents-all-4.2.1-65.el8_4.25, fence-agents-amt-ws-4.2.1-65.el8_4.25 +39
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) fence-agents-4.2.1-65.el8_4.25, fence-agents-all-4.2.1-65.el8_4.25, fence-agents-amt-ws-4.2.1-65.el8_4.25 +36
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.25, fence-agents-aws-4.2.1-65.el8_4.25, fence-agents-azure-arm-4.2.1-65.el8_4.25 +1
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.25, fence-agents-aws-4.2.1-65.el8_4.25, fence-agents-azure-arm-4.2.1-65.el8_4.25 +1
  • RHSA-2026:1795 Released 2026-02-03 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS) resource-agents-4.1.1-61.el7_9.22, resource-agents-aliyun-4.1.1-61.el7_9.22, resource-agents-gcp-4.1.1-61.el7_9.22
    • Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS) resource-agents-4.1.1-61.el7_9.22, resource-agents-aliyun-4.1.1-61.el7_9.22, resource-agents-gcp-4.1.1-61.el7_9.22
    • Red Hat Enterprise Linux Server for SAP ELS (v. 7) resource-agents-4.1.1-61.el7_9.22, resource-agents-sap-4.1.1-61.el7_9.22, sap-cluster-connector-3.0.1-37.el7_9.22
    • Red Hat Enterprise Linux Server for SAPHANA ELS (v. 7) resource-agents-4.1.1-61.el7_9.22, resource-agents-sap-hana-4.1.1-61.el7_9.22, resource-agents-sap-hana-scaleout-0.164.0-6.el7_9.22
  • RHSA-2026:1792 Released 2026-02-03 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents-4.2.1-89.el8_6.20, fence-agents-all-4.2.1-89.el8_6.20, fence-agents-amt-ws-4.2.1-89.el8_6.20 +40
    • Red Hat Enterprise Linux AppStream E4S (v.8.6) fence-agents-4.2.1-89.el8_6.20, fence-agents-all-4.2.1-89.el8_6.20, fence-agents-amt-ws-4.2.1-89.el8_6.20 +41
    • Red Hat Enterprise Linux AppStream TUS (v.8.6) fence-agents-4.2.1-89.el8_6.20, fence-agents-all-4.2.1-89.el8_6.20, fence-agents-amt-ws-4.2.1-89.el8_6.20 +40
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.20, fence-agents-aws-4.2.1-89.el8_6.20, fence-agents-azure-arm-4.2.1-89.el8_6.20 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.20, fence-agents-aws-4.2.1-89.el8_6.20, fence-agents-azure-arm-4.2.1-89.el8_6.20 +1
  • RHSA-2026:1791 Released 2026-02-03 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) fence-agents-4.2.1-112.el8_8.15, fence-agents-all-4.2.1-112.el8_8.15, fence-agents-amt-ws-4.2.1-112.el8_8.15 +40
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) fence-agents-4.2.1-112.el8_8.15, fence-agents-all-4.2.1-112.el8_8.15, fence-agents-amt-ws-4.2.1-112.el8_8.15 +39
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.15, fence-agents-aws-4.2.1-112.el8_8.15, fence-agents-azure-arm-4.2.1-112.el8_8.15 +2
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.15, fence-agents-aws-4.2.1-112.el8_8.15, fence-agents-azure-arm-4.2.1-112.el8_8.15 +2
  • RHSA-2026:1794 Released 2026-02-03 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) resource-agents-4.9.0-40.el8_8.15, resource-agents-aliyun-4.9.0-40.el8_8.15, resource-agents-gcp-4.9.0-40.el8_8.15 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) resource-agents-4.9.0-40.el8_8.15, resource-agents-aliyun-4.9.0-40.el8_8.15, resource-agents-gcp-4.9.0-40.el8_8.15 +1
  • RHSA-2026:1793 Released 2026-02-03 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux High Availability E4S (v.8.6) resource-agents-4.9.0-16.el8_6.19, resource-agents-aliyun-4.9.0-16.el8_6.19, resource-agents-gcp-4.9.0-16.el8_6.19 +1
    • Red Hat Enterprise Linux High Availability TUS (v.8.6) resource-agents-4.9.0-16.el8_6.19, resource-agents-aliyun-4.9.0-16.el8_6.19, resource-agents-gcp-4.9.0-16.el8_6.19 +1
  • RHSA-2026:1735 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.18, fence-agents-common-4.10.0-43.el9_2.18, fence-agents-compute-4.10.0-43.el9_2.18 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.18, fence-agents-all-4.10.0-43.el9_2.18, fence-agents-amt-ws-4.10.0-43.el9_2.18 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.18, fence-agents-all-4.10.0-43.el9_2.18, fence-agents-amt-ws-4.10.0-43.el9_2.18 +39
  • RHSA-2026:1734 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.0) fence-agents-4.10.0-20.el9_0.27, fence-agents-common-4.10.0-20.el9_0.27, fence-agents-compute-4.10.0-20.el9_0.27 +12
    • Red Hat Enterprise Linux High Availability E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.27, fence-agents-all-4.10.0-20.el9_0.27, fence-agents-amt-ws-4.10.0-20.el9_0.27 +40
    • Red Hat Enterprise Linux ResilientStorage E4S (v.9.0) fence-agents-aliyun-4.10.0-20.el9_0.27, fence-agents-all-4.10.0-20.el9_0.27, fence-agents-amt-ws-4.10.0-20.el9_0.27 +39
  • RHSA-2026:1736 Released 2026-02-02 · Red Hat rating Important
    A Subscription Management tool for finding and reporting Red Hat product usage
    • Red Hat Discovery 2 registry.redhat.io/discovery/discovery-server-rhel9, registry.redhat.io/discovery/discovery-ui-rhel9
  • RHSA-2026:1730 Released 2026-02-02 · Red Hat rating Important
    Red Hat Quay 3.12.13
    • Red Hat Quay 3.12 registry.redhat.io/quay/quay-rhel8
  • RHSA-2026:1729 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.6) python-urllib3-1.26.5-6.el9_6.1, python3-urllib3-1.26.5-6.el9_6.1
  • RHSA-2026:1726 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v. 10.0) python-urllib3-1.26.19-2.el10_0.1, python3-urllib3-1.26.19-2.el10_0.1
  • RHSA-2026:1717 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) fence-agents-4.10.0-62.el9_4.21, fence-agents-common-4.10.0-62.el9_4.21, fence-agents-compute-4.10.0-62.el9_4.21 +11
    • Red Hat Enterprise Linux High Availability EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.21, fence-agents-all-4.10.0-62.el9_4.21, fence-agents-amt-ws-4.10.0-62.el9_4.21 +40
    • Red Hat Enterprise Linux Resilient Storage EUS (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.21, fence-agents-all-4.10.0-62.el9_4.21, fence-agents-amt-ws-4.10.0-62.el9_4.21 +39
  • RHSA-2026:1712 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.4) python3.11-urllib3-1.26.12-2.el9_4.3
  • RHSA-2026:1706 Released 2026-02-02 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.14, fence-agents-aliyun-4.10.0-86.el9_6.14, fence-agents-all-4.10.0-86.el9_6.14 +47
  • RHSA-2026:1704 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.11-urllib3-1.26.12-5.el9_6.1
  • RHSA-2026:1693 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.2) python-urllib3-1.26.5-3.el9_2.3, python3-urllib3-1.26.5-3.el9_2.3
  • RHSA-2026:1676 Released 2026-02-02 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) python3.11-urllib3-1.26.12-1.el8_8.3
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) python3.11-urllib3-1.26.12-1.el8_8.3
  • RHSA-2026:1674 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS EUS (v.9.4) python-urllib3-1.26.5-5.el9_4.3, python3-urllib3-1.26.5-5.el9_4.3
  • RHSA-2026:1652 Released 2026-02-02 · Red Hat rating Important
    Red Hat Ceph Storage
    • Red Hat Ceph Storage 8 registry.redhat.io/rhceph/rhceph-8-rhel9
  • RHSA-2026:1619 Released 2026-02-02 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) python3.12-urllib3-1.26.19-1.el9_6.1
  • RHSA-2026:1618 Released 2026-02-02 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS E4S (v.9.0) python-urllib3-1.26.5-3.el9_0.2, python3-urllib3-1.26.5-3.el9_0.2
  • RHSA-2026:1609 Released 2026-01-30 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/controller-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-chatbot-rhel8, registry.redhat.io/ansible-automation-platform-25/lightspeed-rhel8
  • RHSA-2026:1600 Released 2026-01-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-25/de-supported-rhel9
  • RHSA-2026:1599 Released 2026-01-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.4 Container Release Update
    • Red Hat Ansible Automation Platform 2.4 registry.redhat.io/ansible-automation-platform-24/controller-rhel8, registry.redhat.io/ansible-automation-platform-24/lightspeed-rhel8
  • RHSA-2026:1596 Released 2026-01-29 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/controller-rhel9-operator, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9 +7
  • RHSA-2026:1546 Released 2026-01-29 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) python3.11-urllib3-1.26.12-1.el9_2.2
  • RHSA-2026:1506 Released 2026-01-28 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.5 for RHEL 8 automation-controller-venv-tower-4.6.25-1.el8ap, python3.11-django-4.2.27-1.el8ap, python3.11-urllib3-2.6.3-1.el8ap +1
    • Red Hat Ansible Automation Platform 2.5 for RHEL 9 automation-controller-venv-tower-4.6.25-1.el9ap, python3.11-django-4.2.27-1.el9ap, python3.11-urllib3-2.6.3-1.el9ap +1
  • RHSA-2026:1504 Released 2026-01-28 · Red Hat rating Important
    satellite/foreman-mcp-server-rhel9 container image available as a Technology Preview
    • Red Hat Satellite 6.18 registry.redhat.io/satellite/foreman-mcp-server-rhel9
  • RHSA-2026:1497 Released 2026-01-28 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.4 for RHEL 8 automation-controller-venv-tower-4.5.30-1.el8ap, receptor-1.6.3-1.el8ap
    • Red Hat Ansible Automation Platform 2.4 for RHEL 9 automation-controller-venv-tower-4.5.30-1.el9ap, receptor-1.6.3-1.el9ap
  • RHSA-2026:1485 Released 2026-01-28 · Red Hat rating Important
    RHUI 4.11.3 security update - python-urllib3
    • RHUI 4 for RHEL 8 python-urllib3-2.6.3-1.el8ui, python3.11-urllib3-2.6.3-1.el8ui
  • RHSA-2026:1254 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 8) python-urllib3-1.24.2-9.el8_10, python3-urllib3-1.24.2-9.el8_10
  • RHSA-2026:1249 Released 2026-01-26 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Product Security and Bug Fix Update
    • Red Hat Ansible Automation Platform 2.6 for RHEL 10 receptor-1.6.3-2.el10ap
    • Red Hat Ansible Automation Platform 2.6 for RHEL 9 automation-controller-venv-tower-4.7.8-1.el9ap, python3.11-django-4.2.27-2.el9ap, python3.11-protobuf-4.25.8-1.el9ap +2
  • RHSA-2026:1240 Released 2026-01-26 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.20, fence-agents-all-4.2.1-129.el8_10.20, fence-agents-amt-ws-4.2.1-129.el8_10.20 +41
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.20, fence-agents-aws-4.2.1-129.el8_10.20, fence-agents-azure-arm-4.2.1-129.el8_10.20 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.20, fence-agents-aws-4.2.1-129.el8_10.20, fence-agents-azure-arm-4.2.1-129.el8_10.20 +2
  • RHSA-2026:1239 Released 2026-01-26 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-98.el9_7.4, fence-agents-aliyun-4.10.0-98.el9_7.4, fence-agents-all-4.10.0-98.el9_7.4 +47
  • RHSA-2026:1241 Released 2026-01-26 · Red Hat rating Important
    resource-agents security update
    • Red Hat Enterprise Linux HighAvailability (v. 8) resource-agents-4.9.0-54.el8_10.27, resource-agents-aliyun-4.9.0-54.el8_10.27, resource-agents-gcp-4.9.0-54.el8_10.27 +1
    • Red Hat Enterprise Linux ResilientStorage (v. 8) resource-agents-4.9.0-54.el8_10.27, resource-agents-aliyun-4.9.0-54.el8_10.27, resource-agents-gcp-4.9.0-54.el8_10.27 +1
  • RHSA-2026:1226 Released 2026-01-26 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.12-urllib3-1.26.19-2.el8_10
  • RHSA-2026:1224 Released 2026-01-26 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 8) python3.11-urllib3-1.26.12-6.el8_10
  • RHSA-2026:1088 Released 2026-01-26 · Red Hat rating Important
    python3.12-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.12-urllib3-1.26.19-1.el9_7.1
  • RHSA-2026:1089 Released 2026-01-26 · Red Hat rating Important
    python3.11-urllib3 security update
    • Red Hat Enterprise Linux AppStream (v. 9) python3.11-urllib3-1.26.12-5.el9_7.1
  • RHSA-2026:1087 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 9) python-urllib3-1.26.5-6.el9_7.1, python3-urllib3-1.26.5-6.el9_7.1
  • RHSA-2026:1086 Released 2026-01-26 · Red Hat rating Important
    python-urllib3 security update
    • Red Hat Enterprise Linux BaseOS (v. 10) python-urllib3-1.26.19-2.el10_1.1, python3-urllib3-1.26.19-2.el10_1.1
  • RHSA-2026:1176 Released 2026-01-26 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:1168 Released 2026-01-26 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:1166 Released 2026-01-26 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:1042 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:1041 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:1038 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9
  • RHSA-2026:0990 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:0981 Released 2026-01-22 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.18.1
    • Cert Manager support for Red Hat OpenShift release 1.18 registry.redhat.io/cert-manager/cert-manager-istio-csr-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Builds for Red Hat OpenShiftAffectedNo fix yet
Logging Subsystem for Red Hat OpenShiftAffectedNo fix planned: Will not fix
Migration Toolkit for ContainersAffectedNo fix yet
Migration Toolkit for VirtualizationAffectedNo fix planned: Will not fix
Multiarch Tuning OperatorAffectedNo fix yet
OpenShift LightspeedAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat AI Inference ServerAffectedNo fix yet
Red Hat Ansible Automation Platform 2AffectedNo fix yet
Red Hat Ansible Automation Platform Ansible Core 2AffectedNo fix yet
Red Hat Ceph Storage 6AffectedNo fix yet
Red Hat Ceph Storage 7AffectedNo fix yet
Red Hat Ceph Storage 8AffectedNo fix yet
Red Hat Ceph Storage 9AffectedNo fix yet
Red Hat Certification Program for Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Connectivity Link 1AffectedNo fix yet
Red Hat Developer Hub 1AffectedNo fix yet: Fix deferred
Red Hat Discovery 2AffectedNo fix yet
Red Hat Edge Manager previewAffectedNo fix yet
Red Hat Enterprise Linux 10AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix yet
Red Hat Enterprise Linux AI (RHEL AI) 3AffectedNo fix yet
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Dev SpacesAffectedNo fix planned: Will not fix
Red Hat Openshift Data Foundation 4AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Builds for Red Hat OpenShift 1.6.0Fixed RHSA-2026:5549
Cert Manager support for Red Hat OpenShift release 1.18Fixed RHSA-2026:0981, RHSA-2026:0990, RHSA-2026:1038, RHSA-2026:1041, RHSA-2026:1042, RHSA-2026:1166, RHSA-2026:1168, RHSA-2026:1176
Multicluster Global Hub 1.4.9Fixed RHSA-2026:2500
Multicluster Global Hub 1.5.8Fixed RHSA-2026:2256
Network Observability (NETOBSERV) 1.11.0Fixed RHSA-2026:2900
OpenShift API for Data Protection 1.3Fixed RHSA-2026:3444
RHUI 4 for RHEL 8Fixed RHSA-2026:1485
Red Hat AI Inference Server 3.2Fixed RHSA-2026:3461, RHSA-2026:3462, RHSA-2026:61628
Red Hat Advanced Cluster Security 4.8Fixed RHSA-2026:4466
Red Hat Advanced Cluster Security 4.9Fixed RHSA-2026:4467
Red Hat Ansible Automation Platform 2.4Fixed RHSA-2026:1599
Red Hat Ansible Automation Platform 2.4 for RHEL 8Fixed RHSA-2026:1497
Red Hat Ansible Automation Platform 2.4 for RHEL 9Fixed RHSA-2026:1497
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:1600, RHSA-2026:1609
Red Hat Ansible Automation Platform 2.5 for RHEL 8Fixed RHSA-2026:1506
Red Hat Ansible Automation Platform 2.5 for RHEL 9Fixed RHSA-2026:1506
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:1596, RHSA-2026:3960
Red Hat Ansible Automation Platform 2.6 for RHEL 9Fixed RHSA-2026:1249
Red Hat Ceph Storage 7Fixed RHSA-2026:2800
Red Hat Ceph Storage 8Fixed RHSA-2026:1652, RHSA-2026:2737
Red Hat Ceph Storage 9Fixed RHSA-2026:3406
Red Hat Discovery 2Fixed RHSA-2026:1736
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:1224, RHSA-2026:1226, RHSA-2026:1240
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:1088, RHSA-2026:1089, RHSA-2026:1239
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:1803
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:1792
Red Hat Enterprise Linux AppStream E4S (v.8.6)Fixed RHSA-2026:1792
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:1676, RHSA-2026:1791
Red Hat Enterprise Linux AppStream E4S (v.9.0)Fixed RHSA-2026:1734
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:1546, RHSA-2026:1735
Red Hat Enterprise Linux AppStream EUS (v.9.4)Fixed RHSA-2026:1712, RHSA-2026:1717, RHSA-2026:1957
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:1619, RHSA-2026:1704, RHSA-2026:1706
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:1803
Red Hat Enterprise Linux AppStream TUS (v.8.6)Fixed RHSA-2026:1792
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:1676, RHSA-2026:1791
Red Hat Enterprise Linux BaseOS (v. 10)Fixed RHSA-2026:1086
Red Hat Enterprise Linux BaseOS (v. 8)Fixed RHSA-2026:1254
Red Hat Enterprise Linux BaseOS (v. 9)Fixed RHSA-2026:1087
Red Hat Enterprise Linux BaseOS AUS (v. 8.2)Fixed RHSA-2026:2728
Red Hat Enterprise Linux BaseOS AUS (v.8.4)Fixed RHSA-2026:2723
Red Hat Enterprise Linux BaseOS AUS (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS E4S (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS E4S (v.8.8)Fixed RHSA-2026:2718
Red Hat Enterprise Linux BaseOS E4S (v.9.0)Fixed RHSA-2026:1618
Red Hat Enterprise Linux BaseOS E4S (v.9.2)Fixed RHSA-2026:1693
Red Hat Enterprise Linux BaseOS EUS (v. 10.0)Fixed RHSA-2026:1726
Red Hat Enterprise Linux BaseOS EUS (v.9.4)Fixed RHSA-2026:1674
Red Hat Enterprise Linux BaseOS EUS (v.9.6)Fixed RHSA-2026:1729
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)Fixed RHSA-2026:2723
Red Hat Enterprise Linux BaseOS TUS (v.8.6)Fixed RHSA-2026:2717
Red Hat Enterprise Linux BaseOS TUS (v.8.8)Fixed RHSA-2026:2718
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:1803, RHSA-2026:1805
Red Hat Enterprise Linux High Availability E4S (v.8.6)Fixed RHSA-2026:1792, RHSA-2026:1793
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:1791, RHSA-2026:1794
Red Hat Enterprise Linux High Availability E4S (v.9.0)Fixed RHSA-2026:1734
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:1735
Red Hat Enterprise Linux High Availability EUS (v.9.4)Fixed RHSA-2026:1717
Red Hat Enterprise Linux High Availability TUS (v.8.6)Fixed RHSA-2026:1792, RHSA-2026:1793
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:1791, RHSA-2026:1794
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:1240, RHSA-2026:1241
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:1803, RHSA-2026:1805
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:1735
Red Hat Enterprise Linux Resilient Storage EUS (v.9.4)Fixed RHSA-2026:1717
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:1240, RHSA-2026:1241
Red Hat Enterprise Linux ResilientStorage E4S (v.9.0)Fixed RHSA-2026:1734
Red Hat Enterprise Linux Server (v. 7 ELS)Fixed RHSA-2026:9031
Red Hat Enterprise Linux Server -EXTENSION(v. 6 ELS-EXTENSION)Fixed RHSA-2026:11722
Red Hat Enterprise Linux Server HighAvailability (v. 7 ELS)Fixed RHSA-2026:1795, RHSA-2026:2060
Red Hat Enterprise Linux Server ResilientStorage (v. 7 ELS)Fixed RHSA-2026:1795, RHSA-2026:2060
Red Hat Enterprise Linux Server for SAP ELS (v. 7)Fixed RHSA-2026:1795
Red Hat Enterprise Linux Server for SAPHANA ELS (v. 7)Fixed RHSA-2026:1795
Red Hat Migration Toolkit 1.8Fixed RHSA-2026:41928
Red Hat OpenShift AI 2.25Fixed RHSA-2026:10184, RHSA-2026:2106, RHSA-2026:2695, RHSA-2026:3782
Red Hat OpenShift AI 3.3Fixed RHSA-2026:19712, RHSA-2026:3713, RHSA-2026:73987
Red Hat OpenShift AI 3.4Fixed RHSA-2026:60520, RHSA-2026:84734
Red Hat OpenShift Builds 1.7.3Fixed RHSA-2026:6055
Red Hat OpenShift Dev Spaces (RHOSDS) 3.26Fixed RHSA-2026:2456
Red Hat OpenShift GitOps 1.17Fixed RHSA-2026:3869
Red Hat OpenShift GitOps 1.18Fixed RHSA-2026:3874
Red Hat OpenStack Platform 17.1Fixed RHSA-2026:28043
Red Hat Openshift Data Foundation 4.19Fixed RHSA-2026:92650
Red Hat Quay 3.10Fixed RHSA-2026:2762
Red Hat Quay 3.12Fixed RHSA-2026:1730
Red Hat Quay 3.13Fixed RHSA-2026:4185
Red Hat Quay 3.14Fixed RHSA-2026:4215
Red Hat Quay 3.15Fixed RHSA-2026:1942
Red Hat Quay 3.16Fixed RHSA-2026:2681
Red Hat Satellite 6.16 for RHEL 8Fixed RHSA-2026:2765
Red Hat Satellite 6.16 for RHEL 9Fixed RHSA-2026:2765
Red Hat Satellite 6.17Fixed RHSA-2026:44696
Red Hat Satellite 6.17 for RHEL 9Fixed RHSA-2026:2764
Red Hat Satellite 6.18Fixed RHSA-2026:14877, RHSA-2026:1504, RHSA-2026:51357, RHSA-2026:6292
Red Hat Satellite 6.18 for RHEL 9Fixed RHSA-2026:2760
Red Hat Satellite 6.19Fixed RHSA-2026:34527
Red Hat Trusted Artifact Signer 1.2Fixed RHSA-2026:2919, RHSA-2026:2924, RHSA-2026:2925, RHSA-2026:2926
Red Hat Trusted Artifact Signer 1.3Fixed RHSA-2026:2126, RHSA-2026:2137, RHSA-2026:2139, RHSA-2026:2144, RHSA-2026:3296, RHSA-2026:4271, RHSA-2026:5459
Red Hat Update Infrastructure 5Fixed RHSA-2026:2563
mirror registry for Red Hat OpenShift 2.0Fixed RHSA-2026:28441
Not affected: 80 products
  • Assisted Installer for Red Hat OpenShift Container Platform 2
  • Builds for Red Hat OpenShift 1.6.0
  • Cert Manager support for Red Hat OpenShift release 1.18
  • Confidential Compute Attestation
  • Dynamic Accelerator Slicer Operator for Red Hat OpenShift
  • External Secrets Operator for Red Hat OpenShift
  • Fence Agents Remediation Operator
  • Logging Subsystem for Red Hat OpenShift
  • Migration Toolkit for Virtualization
  • Multicluster Engine for Kubernetes
  • Multicluster Global Hub 1.4.9
  • Multicluster Global Hub 1.5.8
  • Network Observability (NETOBSERV) 1.11.0
  • Node HealthCheck Operator
  • OpenShift API for Data Protection
  • OpenShift API for Data Protection 1.3
  • OpenShift Lightspeed
  • OpenShift Service Mesh 2
  • OpenShift Service Mesh 3
  • Red Hat AI Inference Server
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Security 4.8
  • Red Hat Advanced Cluster Security 4.9
  • Red Hat Ansible Automation Platform 2
  • Red Hat Ansible Automation Platform 2.4
  • Red Hat Ansible Automation Platform 2.4 for RHEL 8
  • Red Hat Ansible Automation Platform 2.4 for RHEL 9
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.5 for RHEL 8
  • Red Hat Ansible Automation Platform 2.5 for RHEL 9
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.6 for RHEL 10
  • Red Hat Ansible Automation Platform 2.6 for RHEL 9
  • Red Hat Ceph Storage 7
  • Red Hat Ceph Storage 8
  • Red Hat Ceph Storage 9
  • Red Hat Discovery 2
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3
  • Red Hat Migration Toolkit 1.8
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift AI 2.25
  • Red Hat OpenShift AI 3.3
  • Red Hat OpenShift AI 3.4
  • Red Hat OpenShift Builds 1.7.3
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat OpenShift Dev Spaces (RHOSDS) 3.26
  • Red Hat OpenShift GitOps
  • Red Hat OpenShift GitOps 1.17
  • Red Hat OpenShift GitOps 1.18
  • Red Hat OpenStack Platform 13 (Queens)
  • Red Hat OpenStack Platform 16.2
  • Red Hat OpenStack Platform 17.1
  • Red Hat OpenStack Platform 18.0
  • Red Hat Openshift Data Foundation 4
  • Red Hat Openshift Data Foundation 4.19
  • Red Hat Quay 3
  • Red Hat Quay 3.10
  • Red Hat Quay 3.12
  • Red Hat Quay 3.13
  • Red Hat Quay 3.14
  • Red Hat Quay 3.15
  • Red Hat Quay 3.16
  • Red Hat Satellite 6
  • Red Hat Satellite 6.16 for RHEL 8
  • Red Hat Satellite 6.16 for RHEL 9
  • Red Hat Satellite 6.17 for RHEL 9
  • Red Hat Satellite 6.18 for RHEL 9
  • Red Hat Trusted Artifact Signer 1.2
  • Red Hat Trusted Artifact Signer 1.3
  • Red Hat build of Quarkus Native builder
  • Self Node Remediation Operator
  • Service Telemetry Framework 1.5
  • Zero Trust Workload Identity Manager - Tech Preview
  • external secrets operator for Red Hat OpenShift - Tech Preview

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-66471
  2. 2026-10-03 Alias added: GHSA-2xpw-w6gg-jr37
  3. 2026-10-07 Fix available: RHSA-2026:73987 · Red Hat
  4. 2026-10-09 Affected versions changed · Red Hat
  5. 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.18 · Red Hat
  6. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  7. 2026-10-20 Affected versions changed · Red Hat
  8. 2026-10-27 Affected versions changed · Red Hat
  9. 2026-10-30 Fix available: Red Hat Openshift Data Foundation 4.19 · Red Hat
  10. 2026-10-31 Fix available: RHSA-2026:92650 · Red Hat
  11. 2026-11-06 Fix available: RHSA-2026:2717 · Red Hat
  12. 2026-11-06 Fix available: RHSA-2026:2728 · Red Hat
  13. 2026-11-06 Fix available: RHSA-2026:2919 · Red Hat

References

Patch 1

Advisory 3

Other 4

  • TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
  • TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
  • TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
  • TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
  • TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
  • TI-2020-05823 The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through… CVSS 3.1HIGH 7.5
See all 21 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences