{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An updated version of Red Hat Update Infrastructure (RHUI) is now\navailable. RHUI 4.11.3 resolves several security vulnerabilities.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Update Infrastructure (RHUI) provides a highly scalable and redundant framework for managing repositories and content. It also allows cloud providers to deliver content and updates to Red Hat Enterprise Linux (RHEL) instances.\n\nSecurity Fixes:\n\nPython-urllib3: Unbounded decompression chain leads to resource exhaustion (CVE-2025-66418)\nPython-urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (CVE-2026-21441)\nPython-urllib3: urllib3 Streaming API improperly handles highly compressed data (CVE-2025-66471)\n\nThis update addresses several vulnerabilities within the urllib3 library pertaining to the handling of compressed content (e.g., gzip, deflate, br, or zstd). A remote attacker could potentially provide specially crafted content that, when processed, leads to excessive CPU utilization and significant memory allocation during decompression, potentially resulting in a denial-of-service (DoS) condition.\n\nDeployment Notes:\n\n* RHUA nodes: The updated python3-urllib3 package provided in this errata is intended specifically for Red Hat Update Appliance (RHUA) nodes.\n\n* CDS nodes: Content Delivery Server (CDS) nodes should receive the corresponding update directly from the standard Red Hat Enterprise Linux (RHEL) distribution channels.\n\nImpact Assessment:\n\nUnder standard operating conditions, a properly secured RHUI environment is not expected to be impacted by these vulnerabilities, as the RHUA typically communicates only with trusted endpoints. However, as a matter of security best practice, all RHUI administrators are strongly advised to apply this update to mitigate potential risks.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2026:1485",
        "url": "https://access.redhat.com/errata/RHSA-2026:1485"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "2419455",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419455"
      },
      {
        "category": "external",
        "summary": "2419467",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419467"
      },
      {
        "category": "external",
        "summary": "2427726",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427726"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_1485.json"
      }
    ],
    "title": "Red Hat Security Advisory: RHUI 4.11.3 security update - python-urllib3",
    "tracking": {
      "current_release_date": "2026-02-12T18:22:58+00:00",
      "generator": {
        "date": "2026-02-12T18:22:58+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.7.1"
        }
      },
      "id": "RHSA-2026:1485",
      "initial_release_date": "2026-01-28T11:24:11+00:00",
      "revision_history": [
        {
          "date": "2026-01-28T11:24:11+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2026-01-28T11:24:11+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2026-02-12T18:22:58+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHUI 4 for RHEL 8",
                "product": {
                  "name": "RHUI 4 for RHEL 8",
                  "product_id": "8Base-RHUI-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhui:4::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Update Infrastructure"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python-urllib3-0:2.6.3-1.el8ui.src",
                "product": {
                  "name": "python-urllib3-0:2.6.3-1.el8ui.src",
                  "product_id": "python-urllib3-0:2.6.3-1.el8ui.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python-urllib3@2.6.3-1.el8ui?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "python3.11-urllib3-0:2.6.3-1.el8ui.noarch",
                "product": {
                  "name": "python3.11-urllib3-0:2.6.3-1.el8ui.noarch",
                  "product_id": "python3.11-urllib3-0:2.6.3-1.el8ui.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3.11-urllib3@2.6.3-1.el8ui?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python-urllib3-0:2.6.3-1.el8ui.src as a component of RHUI 4 for RHEL 8",
          "product_id": "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src"
        },
        "product_reference": "python-urllib3-0:2.6.3-1.el8ui.src",
        "relates_to_product_reference": "8Base-RHUI-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3.11-urllib3-0:2.6.3-1.el8ui.noarch as a component of RHUI 4 for RHEL 8",
          "product_id": "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
        },
        "product_reference": "python3.11-urllib3-0:2.6.3-1.el8ui.noarch",
        "relates_to_product_reference": "8Base-RHUI-4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-66418",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "discovery_date": "2025-12-05T17:01:20.277857+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2419455"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.24 and prior to 2.6.0, the number of links in the decompression chain was unbounded allowing a malicious server to insert a virtually unlimited number of compression steps leading to high CPU usage and massive memory allocation for the decompressed data. This vulnerability is fixed in 2.6.0.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
          "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "RHBZ#2419455",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419455"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66418"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8",
          "url": "https://github.com/urllib3/urllib3/commit/24d7b67eac89f94e11003424bcf0d8f7b72222a8"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-gm62-xv2j-4w53"
        }
      ],
      "release_date": "2025-12-05T16:02:15.271000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-01-28T11:24:11+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\n1. Apply the update\n\nThis update is delivered via a package update, not a new installer. To apply the fix, update the necessary package:\n\ndnf -y update python3.11-urllib3\n\n(Alternatively, rerunning the current rhui-installer will also install this package update automatically.)\n\n2. Restart RHUI services\n\nExecute the following command for the update to take effect:\n\nrhui-services-restart\n\n(Alternatively, if you have rerun the installer, this command is not needed because rerunning the installer restarts RHUI services automatically.)",
          "product_ids": [
            "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
            "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:1485"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
            "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3: Unbounded decompression chain leads to resource exhaustion"
    },
    {
      "cve": "CVE-2025-66471",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2025-12-05T17:02:21.597728+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2419467"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "urllib3 is a user-friendly HTTP client library for Python. Starting in version 1.0 and prior to 2.6.0, the Streaming API improperly handles highly compressed data. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. When streaming a compressed response, urllib3 can perform decoding or decompression based on the HTTP Content-Encoding header (e.g., gzip, deflate, br, or zstd). The library must read compressed data from the network and decompress it until the requested chunk size is met. Any resulting decompressed data that exceeds the requested amount is held in an internal buffer for the next read operation. The decompression logic could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This can result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3 Streaming API improperly handles highly compressed data",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
          "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "RHBZ#2419467",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2419467"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2025-66471",
          "url": "https://www.cve.org/CVERecord?id=CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-66471"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7",
          "url": "https://github.com/urllib3/urllib3/commit/c19571de34c47de3a766541b041637ba5f716ed7"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-2xpw-w6gg-jr37"
        }
      ],
      "release_date": "2025-12-05T16:06:08.531000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-01-28T11:24:11+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\n1. Apply the update\n\nThis update is delivered via a package update, not a new installer. To apply the fix, update the necessary package:\n\ndnf -y update python3.11-urllib3\n\n(Alternatively, rerunning the current rhui-installer will also install this package update automatically.)\n\n2. Restart RHUI services\n\nExecute the following command for the update to take effect:\n\nrhui-services-restart\n\n(Alternatively, if you have rerun the installer, this command is not needed because rerunning the installer restarts RHUI services automatically.)",
          "product_ids": [
            "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
            "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:1485"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
            "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
            "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3 Streaming API improperly handles highly compressed data"
    },
    {
      "cve": "CVE-2026-21441",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "discovery_date": "2026-01-07T23:01:59.422078+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "2427726"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "urllib3 is an HTTP client library for Python. urllib3\u0027s streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decoding or decompression based on the HTTP `Content-Encoding` header (e.g., `gzip`, `deflate`, `br`, or `zstd`). When using the streaming API, the library decompresses only the necessary bytes, enabling partial content consumption. Starting in version 1.22 and prior to version 2.6.3, for HTTP redirect responses, the library would read the entire response body to drain the connection and decompress the content unnecessarily. This decompression occurred even before any read methods were called, and configured read limits did not restrict the amount of decompressed data. As a result, there was no safeguard against decompression bombs. A malicious server could exploit this to trigger excessive resource consumption on the client. Applications and libraries are affected when they stream content from untrusted sources by setting `preload_content=False` when they do not disable redirects. Users should upgrade to at least urllib3 v2.6.3, in which the library does not decode content of redirect responses when `preload_content=False`. If upgrading is not immediately possible, disable redirects by setting `redirect=False` for requests to untrusted source.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
          "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "RHBZ#2427726",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2427726"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2026-21441",
          "url": "https://www.cve.org/CVERecord?id=CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21441"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b",
          "url": "https://github.com/urllib3/urllib3/commit/8864ac407bba8607950025e0979c4c69bc7abc7b"
        },
        {
          "category": "external",
          "summary": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99",
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-38jv-5279-wg99"
        }
      ],
      "release_date": "2026-01-07T22:09:01.936000+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2026-01-28T11:24:11+00:00",
          "details": "Before applying this update, make sure all previously released errata relevant\nto your system have been applied.\n\n1. Apply the update\n\nThis update is delivered via a package update, not a new installer. To apply the fix, update the necessary package:\n\ndnf -y update python3.11-urllib3\n\n(Alternatively, rerunning the current rhui-installer will also install this package update automatically.)\n\n2. Restart RHUI services\n\nExecute the following command for the update to take effect:\n\nrhui-services-restart\n\n(Alternatively, if you have rerun the installer, this command is not needed because rerunning the installer restarts RHUI services automatically.)",
          "product_ids": [
            "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
            "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2026:1485"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHUI-4:python-urllib3-0:2.6.3-1.el8ui.src",
            "8Base-RHUI-4:python3.11-urllib3-0:2.6.3-1.el8ui.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)"
    }
  ]
}