CVE-2025-50182

CWE-601 — Open Redirect12 documents8 sources
Severity
6.1MEDIUM
EPSS
0.0%
top 93.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Python Urllib3Urllib3 Urllib3
Timeline
PublishedJun 19
Latest updateJun 26

Description

urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodi…

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages5 packages

▶NVDpython/urllib32.2.0 — 2.5.0
▶Debianpython-urllib3< 2.3.0-3+1
▶Ubuntupython-urllib3< 1.26.5-1~exp1ubuntu0.3+4
▶PyPIurllib32.2.0 — 2.5.0
▶CVEListV5urllib3/urllib3>= 2.2.0, < 2.5.0

Patches

Patch: github.com ↗

🔴Vulnerability Details

6
OSV
python-pip vulnerability↗2025-06-26
▶
OSV
python-urllib3 vulnerabilities↗2025-06-25
▶
OSV
CVE-2025-50182: urllib3 is a user-friendly HTTP client library for Python↗2025-06-19
▶
CVEList
urllib3 does not control redirects in browsers and Node.js↗2025-06-19
▶
OSV
urllib3 does not control redirects in browsers and Node.js↗2025-06-18
▶

📋Vendor Advisories

5
Ubuntu
urllib3 vulnerabilities↗2025-06-25
▶
Red Hat
urllib3: urllib3 does not control redirects in browsers and Node.js↗2025-06-19
▶
Microsoft
urllib3 does not control redirects in browsers and Node.js↗2025-06-10
▶
Debian
CVE-2025-50182: python-urllib3 - urllib3 is a user-friendly HTTP client library for Python. Starting in version 2...↗2025
▶
Microsoft
secretmem: disable memfd_secret() if arch cannot set direct map↗2024-11-12
▶
CVE-2025-50182 (MEDIUM CVSS 6.1) | urllib3 is a user-friendly HTTP cli | cvebase.io