medium 5.3

CVE-2025-50181 json

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

published 2025-06-18 16 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-18908 , GHSA-pq67-6m6q-mj2v , PYSEC-2026-1999

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

Patch / fix

fixed in 2 distros 5 links 2

pypi urllib3 2.5.0
python urllib3 2.5.0

debian ubuntu suse opensuse azure linux

python-urllib3 Debian 12 1.26.12-1+deb12u2
python-urllib3 Debian 14, Debian 13 2.3.0-3

debian advisories DEBIAN-CVE-2025-50181

python-pip Ubuntu 22.04 LTS 22.0.2+dfsg-1ubuntu0.6
python-pip Ubuntu 24.04 LTS 24.0+dfsg-1ubuntu1.2
python-urllib3 Ubuntu 22.04 LTS 1.26.5-1~exp1ubuntu0.3
python-urllib3 Ubuntu 24.04 LTS 2.0.7-1ubuntu0.2
python-urllib3 Ubuntu Pro 16.04 LTS 1.13.1-2ubuntu0.16.04.4+esm3
python-urllib3 Ubuntu Pro 18.04 LTS 1.22-1ubuntu0.18.04.2+esm3
python-urllib3 Ubuntu Pro 20.04 LTS 1.25.8-2ubuntu0.4+esm1

ubuntu advisories UBUNTU-CVE-2025-50181

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

python-urllib3 Linux Micro 6.1 2.1.0-slfo.1.1_2.1
python-urllib3 SLE Module for Basesystem 15 SP7, SLE Module for Basesystem 15 SP6, SLE Micro 5.5 +4 more 1.25.10-150300.4.18.1
python-urllib3 Linux Micro 6.0 2.1.0-3.1
python-urllib3 SLES LTSS Extended Security 12 SP5, SLE Module for Public Cloud 12 1.25.10-3.43.1
python-urllib3 SLE Module for Python 3 15 SP7, SLE Module for Python 3 15 SP6, SLE Module for Public Cloud 15 SP4 +1 more 2.0.7-150400.7.21.1

suse advisories SUSE-SU-2025:20856-1 SUSE-SU-2025:02985-1 SUSE-SU-2025:20558-1 SUSE-SU-2025:02736-1 SUSE-SU-2025:02735-1

oci-cli openSUSE Tumbleweed 3.76.2-1.1
python-urllib3 openSUSE Tumbleweed 2.5.0-1.1
python-urllib3_1 openSUSE Tumbleweed 1.26.20-3.1

opensuse advisories openSUSE-SU-2026:10539-1 openSUSE-SU-2025:15283-1 openSUSE-SU-2025:15284-1

python-urllib3 CBL-Mariner 2.0 1.26.19-2
python-urllib3 Azure Linux 3.0 2.0.7-2
python-virtualenv CBL-Mariner 2.0 20.26.6-2
python-pip Azure Linux 3.0 24.2-5
python-virtualenv Azure Linux 3.0 20.36.1-2

azure linux advisories AZL-64170 AZL-64175 AZL-64218 AZL-64244 AZL-77823

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

github.com/urllib3/urllib3@f05b132 commit
github.com/urllib3/urllib3/releases/tag/2.5.0 release

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2025-50181 updated 2026-11-05 cvss 5.3

urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Red Hat Assisted Installer for Red Hat OpenShift Container Platform 2 rhai/assisted-installer-rhel9, rhai/assisted-installer-agent-rhel9, rhai/assisted-installer-controller-rhel9
affected: workaround, no fix planned “Out of support scope”
Red Hat Builds for Red Hat OpenShift openshift-builds/openshift-builds-shared-resource-rhel9, openshift-builds/openshift-builds-shared-resource-webhook-rhel9 Red Hat cert-manager Operator for Red Hat OpenShift cert-manager/cert-manager-operator-rhel9, cert-manager/jetstack-cert-manager-rhel9, cert-manager/cert-manager-istio-csr-rhel9, cert-manager/jetstack-cert-manager-acmesolver-rhel9 Red Hat Confidential Compute Attestation confidential-compute-attestation-tech-preview/trustee-rhel9 Red Hat Custom Metric Autoscaler operator for Red Hat Openshift custom-metrics-autoscaler/custom-metrics-autoscaler-operator-bundle
affected: workaround, no fix available “Fix deferred”
Red Hat Migration Toolkit for Virtualization mtv-candidate/mtv-api-rhel9, mtv-candidate/mtv-rhel9-operator, mtv-candidate/mtv-virt-v2v-rhel9, mtv-candidate/mtv-validation-rhel9, mtv-candidate/mtv-must-gather-rhel8, mtv-candidate/mtv-rhv-populator-rhel8, +5 more
affected: workaround, no fix planned “Will not fix”
Red Hat Multiarch Tuning Operator multiarch-tuning/multiarch-tuning-rhel9-operator
affected: workaround, no fix available “Fix deferred”
Red Hat Network Observability Operator network-observability/network-observability-cli-rhel9
affected: workaround, no fix planned “Will not fix”
Red Hat OpenShift Lightspeed openshift-lightspeed/lightspeed-service-api-rhel9, openshift-lightspeed/lightspeed-console-plugin-rhel9
affected: workaround, no fix available “Fix deferred”
Red Hat OpenShift Pipelines openshift-pipelines/pipelines-nop-rhel8, openshift-pipelines/pipelines-events-rhel8, openshift-pipelines/pipelines-hub-ui-rhel8, openshift-pipelines/pipelines-hub-ui-rhel9, openshift-pipelines/pipelines-cli-tkn-rhel8, openshift-pipelines/pipelines-hub-api-rhel8, +29 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat OpenShift Serverless openshift-serverless-1/kn-eventing-istio-controller-rhel8 Red Hat OpenShift Service Mesh 3 openshift-service-mesh/istio-cni-rhel9, openshift-service-mesh/istio-pilot-rhel9, openshift-service-mesh/kiali-ossmc-rhel9, openshift-service-mesh/istio-proxyv2-rhel9, openshift-service-mesh/istio-rhel9-operator, openshift-service-mesh/kiali-rhel9-operator, +3 more Red Hat AI Inference Server rhaiis/vllm-cuda-rhel9, rhaiis/vllm-rocm-rhel9
affected: workaround, no fix available “Fix deferred”

show 13 more

Red Hat Ansible Automation Platform 2 automation-controller, ee-dellemc-openmanage-container, aap-cloud-metrics-collector-container, ansible-automation-platform-24/de-minimal-rhel8, ansible-automation-platform-24/de-minimal-rhel9, ansible-automation-platform-24/lightspeed-rhel8, +11 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Ceph Storage 6 grafana Red Hat Ceph Storage 7 grafana Red Hat Ceph Storage 8 grafana Red Hat Ceph Storage 9 grafana
affected: workaround, no fix available
Red Hat Developer Hub 1 rhdh/rhdh-hub-rhel9, rhdh/rhdh-rhel9-operator
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Discovery 1 discovery/discovery-server-rhel9 Red Hat Edge Manager preview rhem/flightctl-ui-rhel9, rhem/flightctl-api-rhel9, rhem/flightctl-ui-ocp-rhel9, rhem/flightctl-worker-rhel9, rhem/flightctl-periodic-rhel9, rhem/flightctl-cli-artifacts-rhel9 Red Hat Enterprise Linux 7 python-pip, python3-pip, resource-agents, python-s3transfer, resource-agents-gcp, resource-agents-sap, +4 more Red Hat Enterprise Linux 8 python-pip, python3-pip, fence-agents, python3.11-pip, python3.12-pip, fence-agents-all, +51 more Red Hat Enterprise Linux 9 fence-virt, python-pip, fence-virtd, python3-pip, fence-agents, python3.11-pip, +60 more Red Hat Enterprise Linux 10 python-pip
affected: workaround, no fix available “Fix deferred”
Red Hat Enterprise Linux AI (RHEL AI) rhelai1/ui-rhel9, rhelai1/gemma-2-9b-it, rhelai1/bootc-amd-rhel9, rhelai1/bootc-intel-rhel9, rhelai1/gemma-2-9b-it-fp8, rhelai1/granite-8b-lab-v1, +47 more
affected: workaround, no fix available, no fix planned “Will not fix”
Red Hat Offline Knowledge Portal offline-knowledge-portal/rhokp-rhel9 Red Hat OpenShift AI (RHOAI) rhoai/odh-dashboard-rhel8, rhoai/odh-feast-operator-rhel8, rhoai/odh-feature-server-rhel8, rhoai/odh-model-registry-rhel8, rhoai/odh-trustyai-service-rhel8, rhoai/odh-notebook-controller-rhel8, +4 more Red Hat OpenShift Container Platform 4 openshift4/ose-ansible-operator, openshift4/microshift-bootc-rhel9, openshift4/ose-olm-catalogd-rhel8, openshift4/ose-olm-catalogd-rhel9, openshift4/ztp-site-generate-rhel8, openshift4/ose-ansible-rhel9-operator, +2 more Red Hat Satellite 6 satellite/iop-advisor-engine-rhel9
affected: workaround, no fix available “Fix deferred”
Red Hat Trusted Artifact Signer rhtas/tuffer-rhel9, rhtas/tuftool-rhel9, rhtas/rekor-cli-rhel9, rhtas/rekor-server-rhel9, rhtas/client-server-rhel9, rhtas/trillian-redis-rhel9, +4 more
affected: workaround, no fix planned “Will not fix”
Red Hat Ceph Storage 7.1 rhceph/grafana-rhel9 1781855851, rhceph/grafana-rhel9 1791450715
fixed: vendor fix RHSA-2026:83548
Red Hat Ceph Storage 8.1 rhceph/grafana-rhel9 1787305054
fixed: vendor fix RHSA-2026:62115
Red Hat Ceph Storage 9 rhceph 1771399331
fixed: vendor fix RHSA-2026:3406
Red Hat Ceph Storage 9.2 rhceph/rhceph-9-rhel10 1790843527
fixed: vendor fix RHSA-2026:86618
Red Hat Quay 3.14 quay 1773097621
fixed: vendor fix RHSA-2026:4215
Red Hat build of Quarkus Native builder mandrel-for-jdk-21-rhel8 Red Hat Ceph Storage 7.1 rhceph/rhceph-7-rhel9 1781863705, rhceph/rhceph-7-rhel9 1791452477, rhceph/keepalived-rhel9 1781855108, rhceph/keepalived-rhel9 1791453133, rhceph/snmp-notifier-rhel9 1781854814, rhceph/snmp-notifier-rhel9 1791450035, +4 more Red Hat Ceph Storage 8.1 rhceph/rhceph-8-rhel9 1787550654, rhceph/keepalived-rhel9 1787303659, rhceph/oauth2-proxy-rhel9 1787304106, rhceph/snmp-notifier-rhel9 1787303640, rhceph/rhceph-haproxy-rhel9 1787304199, rhceph/rhceph-promtail-rhel9 1787304137 Red Hat Ceph Storage 9 rhceph 1771398877, rhceph 1771399022, rhceph 1771399060, rhceph 1771399158, rhceph 1771816028
not affected: vulnerable code not present

5 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 16 mo ago (2025-06-23)

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

github.com https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD	3.1	6.1	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
OSV	3.1	5.3	CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	urllib3	<2.5.0	2.5.0

Affected products

urllib3 urllib3

Classification

Weakness

CWE-601 URL Redirection to Untrusted Site

References

github.com /urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
web, patch
github.com /urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v
web, exploit, vendor-advisory
github.com /urllib3/urllib3/releases/tag/2.5.0
web
nvd.nist.gov /vuln/detail/CVE-2025-50181
advisory
github.com /urllib3/urllib3
package
pypi.org /project/urllib3
package
github.com /advisories/GHSA-pq67-6m6q-mj2v
advisory

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.

Summary