CVE-2025-50181

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Description

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

References

Link	Tags
https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v
https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857

Frequently Asked Questions

What is the severity of CVE-2025-50181?: CVE-2025-50181 has been scored as a medium severity vulnerability.
How to fix CVE-2025-50181?: To fix CVE-2025-50181, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2025-50181 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2025-50181 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2025-50181?: CVE-2025-50181 affects urllib3 urllib3.

This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.

Description

Category

CWE-601 – URL Redirection to Untrusted Site ('Open Redirect')

References

Frequently Asked Questions