CVE-2025-50182
published 2025-06-19CVE-2025-50182: urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and…
PriorityP429medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
0.32%
24.1th percentile
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | python-urllib3 | < python-urllib3 2.3.0-3 (forky) | python-urllib3 2.3.0-3 (forky) |
| msrc | azl3_python-urllib3_2.0.7-1_on_azure_linux_3.0 | — | — |
| msrc | azl3_tensorflow_2.16.1-9_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kernel_5.15.167.1-2_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kernel_5.15.173.1-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_python-urllib3_1.26.19-1_on_cbl_mariner_2.0 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| python | urllib3 | >= 2.2.0 < 2.5.0 | 2.5.0 |
| urllib3 | urllib3 | — | — |
| urllib3 | urllib3 | >= 2.2.0 < 2.5.0 | 2.5.0 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
osv6.1MEDIUM
vendor_msrc5.5MEDIUM
vendor_debian5.3LOW
vendor_redhat5.3MEDIUM
vendor_ubuntu5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
python-pip vulnerability
osv·2025-06-26·CVSS 6.1
CVE-2025-50181 [MEDIUM] python-pip vulnerability
python-pip vulnerability
USN-7599-1 fixed vulnerabilities in python-urllib3. This update provides
the corresponding update for python-pip for CVE-2025-50181.
Original advisory details:
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
OSV
python-urllib3 vulnerabilities
osv·2025-06-25·CVSS 6.1
CVE-2025-50181 [MEDIUM] python-urllib3 vulnerabilities
python-urllib3 vulnerabilities
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
OSV
CVE-2025-50182: urllib3 is a user-friendly HTTP client library for Python
osv·2025-06-19·CVSS 6.1
CVE-2025-50182 [MEDIUM] CVE-2025-50182: urllib3 is a user-friendly HTTP client library for Python
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
OSV
urllib3 does not control redirects in browsers and Node.js
osv·2025-06-18
CVE-2025-50182 [MEDIUM] urllib3 does not control redirects in browsers and Node.js
urllib3 does not control redirects in browsers and Node.js
urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.
However, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.
## Affected usages
Any code which relies on urllib3 t
GHSA
urllib3 does not control redirects in browsers and Node.js
ghsa·2025-06-18
CVE-2025-50182 [MEDIUM] CWE-601 urllib3 does not control redirects in browsers and Node.js
urllib3 does not control redirects in browsers and Node.js
urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.
However, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.
## Affected usages
Any code which relies on urllib3 t
Ubuntu
pip vulnerability
vendor_ubuntu·2025-06-26·CVSS 5.3
CVE-2025-50181 [MEDIUM] pip vulnerability
Title: pip vulnerability
Summary: pip could be made to expose sensitive information over the network.
USN-7599-1 fixed vulnerabilities in python-urllib3. This update provides
the corresponding update for python-pip for CVE-2025-50181.
Original advisory details:
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
Instructions: In general, a standard system update will make all the necessa
Ubuntu
urllib3 vulnerabilities
vendor_ubuntu·2025-06-25·CVSS 5.3
CVE-2025-50182 [MEDIUM] urllib3 vulnerabilities
Title: urllib3 vulnerabilities
Summary: urllib3 could be made to expose sensitive information over the network.
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
urllib3: urllib3 does not control redirects in browsers and Node.js
vendor_redhat·2025-06-19·CVSS 5.3
CVE-2025-50182 [MEDIUM] CWE-601 urllib3: urllib3 does not control redirects in browsers and Node.js
urllib3: urllib3 does not control redirects in browsers and Node.js
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
A flaw was found in urllib3. The library fails to properly validate redirect URLs, allowing an attacker to manipulate redirect chai
Microsoft
urllib3 does not control redirects in browsers and Node.js
vendor_msrc·2025-06-10·CVSS 5.3
CVE-2025-50182 [MEDIUM] CWE-601 urllib3 does not control redirects in browsers and Node.js
urllib3 does not control redirects in browsers and Node.js
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Debian
CVE-2025-50182: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Starting in version 2...
vendor_debian·2025·CVSS 5.3
CVE-2025-50182 [MEDIUM] CVE-2025-50182: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Starting in version 2...
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 2.3.0-3)
sid: resolved (fixed in 2.3.0-3)
trixie: resolved (fixed in 2.3.0-3)
Microsoft
secretmem: disable memfd_secret() if arch cannot set direct map
vendor_msrc·2024-11-12·CVSS 5.5
CVE-2024-50182 [MEDIUM] secretmem: disable memfd_secret() if arch cannot set direct map
secretmem: disable memfd_secret() if arch cannot set direct map
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more information. If impact to additional products is identified, we will update the CVE to reflect this.
Mariner: Mariner
Linux: Linux
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2025-50182 urllib3: urllib3 does not control redirects in browsers and Node.js
bugzilla·2025-06-19·CVSS 6.1
CVE-2025-50182 [MEDIUM] CVE-2025-50182 urllib3: urllib3 does not control redirects in browsers and Node.js
CVE-2025-50182 urllib3: urllib3 does not control redirects in browsers and Node.js
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Bugzilla
CVE-2025-50182 python3.6: urllib3 does not control redirects in browsers and Node.js [fedora-42]
bugzilla·2025-06-19·CVSS 6.1
CVE-2025-50182 [MEDIUM] CVE-2025-50182 python3.6: urllib3 does not control redirects in browsers and Node.js [fedora-42]
CVE-2025-50182 python3.6: urllib3 does not control redirects in browsers and Node.js [fedora-42]
More information about this security flaw is available in the following bug:
https://bugzilla.redhat.com/show_bug.cgi?id=2373800
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
Discussion:
We (Python-maint team) have decided not to proactively fix CVEs that are not present or requested to be fixed in RHEL for EOL Python interpreters that are in Fedora only for testing purposes.
---
This message is a reminder that Fedora Linux 42 is nearing its end of life.
Fedora will stop maintaining and issuing updates for Fedora
2025-06-19
Published