Vulnerability · Published Jun 19, 2025 · Assigned by GitHub_M
CVE-2025-50181urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Medium 5.3
In plain English
A medium-severity open redirect in urllib3 from urllib3. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | python-urllib3 | 1.26.12-1+deb12u2 | DEBIAN-CVE-2025-50181 |
| Debian:13 | python-urllib3 | 2.3.0-3 | DEBIAN-CVE-2025-50181 |
| Debian:14 | python-urllib3 | 2.3.0-3 | DEBIAN-CVE-2025-50181 |
| PyPI | urllib3 | 2.5.0 | PYSEC-2026-1999 |
| PyPI | urllib3 | 2.5.0 | GHSA-pq67-6m6q-mj2v |
| Ubuntu:22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.6 | USN-7599-2 |
| Ubuntu:22.04:LTS | python-pip | 22.0.2+dfsg-1ubuntu0.6 | UBUNTU-CVE-2025-50181 |
| Ubuntu:24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.2 | USN-7599-2 |
| Ubuntu:24.04:LTS | python-pip | 24.0+dfsg-1ubuntu1.2 | UBUNTU-CVE-2025-50181 |
| Ubuntu:22.04:LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.3 | USN-7599-1 |
| Ubuntu:22.04:LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.3 | UBUNTU-CVE-2025-50181 |
| Ubuntu:24.04:LTS | python-urllib3 | 2.0.7-1ubuntu0.2 | UBUNTU-CVE-2025-50181 |
| Ubuntu:24.04:LTS | python-urllib3 | 2.0.7-1ubuntu0.2 | USN-7599-1 |
Affected products (as reported)
Weakness: CWE-601 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v x_refsource_CONFIRM
- https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857 x_refsource_MISC
- https://github.com/urllib3/urllib3/releases/tag/2.5.0 x_refsource_MISC