Medium severity · published Jun 19, 2025
CVE-2025-50181
urllib3 is a user-friendly HTTP client library for Python
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UR
Urllib3 · Python
before 2.5.0 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-50181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-50181
Patch
https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
github.com
https://github.com/urllib3/urllib3/releases/tag/2.5.0
Exploit
https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v
More from Urllib3
9.8
CVE-2018-20060
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme)
8.1
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
8.1
CVE-2023-43804
urllib3 is a user-friendly HTTP client library for Python
7.5
CVE-2026-97689
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
7.5
CVE-2026-44432
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API