CVE-2025-50181
published 2025-06-19CVE-2025-50181: urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager…
PriorityP428medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.41%
33.1th percentile
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-urllib3 | < python-urllib3 1.26.12-1+deb12u2 (bookworm) | python-urllib3 1.26.12-1+deb12u2 (bookworm) |
| msrc | azl3_python-pip_24.2-3_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-pip_24.2-4_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-pip_24.2-5_on_azure_linux_3.0 | — | — |
| msrc | azl3_python-urllib3_2.0.7-2_on_azure_linux_3.0 | — | — |
| msrc | azl3_python3_3.12.9-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.167.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.173.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-urllib3_1.26.19-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-urllib3_1.26.19-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-virtualenv_20.26.6-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-virtualenv_20.26.6-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python3_3.9.19-13_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| python | urllib3 | < 2.5.0 | 2.5.0 |
| urllib3 | urllib3 | < 2.5.0 | 2.5.0 |
| urllib3 | urllib3 | >= 0 < 2.5.0 | 2.5.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_debian5.3MEDIUM
vendor_msrc5.3MEDIUM
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-pip vulnerability
osv·2025-06-26·CVSS 6.1
CVE-2025-50181 [MEDIUM] python-pip vulnerability
python-pip vulnerability
USN-7599-1 fixed vulnerabilities in python-urllib3. This update provides
the corresponding update for python-pip for CVE-2025-50181.
Original advisory details:
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
OSV
python-urllib3 vulnerabilities
osv·2025-06-25·CVSS 6.1
CVE-2025-50181 [MEDIUM] python-urllib3 vulnerabilities
python-urllib3 vulnerabilities
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
OSV
CVE-2025-50181: urllib3 is a user-friendly HTTP client library for Python
osv·2025-06-19·CVSS 6.1
CVE-2025-50181 [MEDIUM] CVE-2025-50181: urllib3 is a user-friendly HTTP client library for Python
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
GHSA
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
ghsa·2025-06-18
CVE-2025-50181 [MEDIUM] CWE-601 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:
```python
resp = urllib3.request("GET", "https://httpbin.org/redirect/1", redirect=False)
print(resp.status)
# 302
```
However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:
```python
import urllib3
http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect
http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above
http = urllib3.PoolManager(retries=False) # shoul
OSV
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
osv·2025-06-18
CVE-2025-50181 [MEDIUM] urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:
```python
resp = urllib3.request("GET", "https://httpbin.org/redirect/1", redirect=False)
print(resp.status)
# 302
```
However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:
```python
import urllib3
http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect
http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above
http = urllib3.PoolManager(retries=False) # shoul
Oracle
Oracle Oracle PeopleSoft Risk Matrix: Porting (urllib3) — CVE-2025-50181
vendor_oracle·2025-10-15·CVSS 5.3
CVE-2025-50181 [MEDIUM] Oracle Oracle PeopleSoft Risk Matrix: Porting (urllib3) — CVE-2025-50181
Oracle Oracle PeopleSoft Risk Matrix: Porting (urllib3) vulnerability
CVE: CVE-2025-50181
CVSS: 5.3
Protocol: HTTP
Remote exploit: No
Affected versions: Network
Advisory: cpuoct2025 (OCT 2025)
Ubuntu
pip vulnerability
vendor_ubuntu·2025-06-26·CVSS 5.3
CVE-2025-50181 [MEDIUM] pip vulnerability
Title: pip vulnerability
Summary: pip could be made to expose sensitive information over the network.
USN-7599-1 fixed vulnerabilities in python-urllib3. This update provides
the corresponding update for python-pip for CVE-2025-50181.
Original advisory details:
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
Instructions: In general, a standard system update will make all the necessa
Ubuntu
urllib3 vulnerabilities
vendor_ubuntu·2025-06-25·CVSS 5.3
CVE-2025-50182 [MEDIUM] urllib3 vulnerabilities
Title: urllib3 vulnerabilities
Summary: urllib3 could be made to expose sensitive information over the network.
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
vendor_redhat·2025-06-19·CVSS 5.3
CVE-2025-50181 [MEDIUM] CWE-601 urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configu
Microsoft
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
vendor_msrc·2025-06-10·CVSS 5.3
CVE-2025-50181 [MEDIUM] CWE-601 urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Ma
Debian
CVE-2025-50181: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is...
vendor_debian·2025·CVSS 5.3
CVE-2025-50181 [MEDIUM] CVE-2025-50181: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is...
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
Scope: local
bookworm: resolved (fixed in 1.26.12-1+deb12u2)
bullseye: resolved (fixed in 1.26.5-1~exp1+deb11u2)
forky: resolved (fixed in 2.3.0-3)
sid: resolved (fixed in 2.3.0-3)
trixie: resolved (fixed in 2.3.0-3)
Microsoft
clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
vendor_msrc·2024-11-12
CVE-2024-50181 [MEDIUM] clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
clk: imx: Remove CLK_SET_PARENT_GATE for DRAM mux for i.MX7D
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-50181 pypy: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation [fedora-42]
bugzilla·2025-07-25·CVSS 5.3
CVE-2025-50181 [MEDIUM] CVE-2025-50181 pypy: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation [fedora-42]
CVE-2025-50181 pypy: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation [fedora-42]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
The following link provides references to all essential vulnerability management information. If something is wrong or missing, please contact a member of PSIRT.
https://spaces.redhat.com/display/PRODSEC/Vulnerability+Management+-+Essential+Documents+for+Engineering+Teams
Discussion:
This is already fixed through https://src.fedoraproject.org/rpms/pypy/c/74646552af15dc1308cce8457a4163940f76ee2e?branch=f42
Bugzilla
CVE-2025-50181 python3.6: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation [fedora-42]
bugzilla·2025-06-19·CVSS 6.1
CVE-2025-50181 [MEDIUM] CVE-2025-50181 python3.6: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation [fedora-42]
CVE-2025-50181 python3.6: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2373799
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
We (Python-maint team) have decided not to proactively fix CVEs that are not present or requested to be fixed in RHEL for EOL Python interpreters that are in Fedora only for testing purposes.
---
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining
Bugzilla
CVE-2025-50181 urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
bugzilla·2025-06-19·CVSS 6.1
CVE-2025-50181 [MEDIUM] CVE-2025-50181 urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
CVE-2025-50181 urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
2025-06-19
Published