p PatchFirst

CVE-2025-50181

CVE-2025-50181 · urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

CVSS 5.3 · Medium · EPSS 0.5% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • urllib3

    Versions
    • < 2.5.0: Affected

    No fix published

  • python-urllib3 Debian:12

    Versions
    • 1.26.12-1
    • 1.26.12-1+deb12u1
    Affected ranges
    • ECOSYSTEM: < 1.26.12-1+deb12u2

    Update to 1.26.12-1+deb12u2

  • python-urllib3 Debian:13

    Affected ranges
    • ECOSYSTEM: < 2.3.0-3

    Update to 2.3.0-3

  • python-urllib3 Debian:14

    Affected ranges
    • ECOSYSTEM: < 2.3.0-3

    Update to 2.3.0-3

  • urllib3 PyPI

    Versions
    • 0.2
    • 0.3
    • 0.3.1
    • 0.4.0
    • 0.4.1
    • 1.0
    • 1.0.1
    • 1.0.2
    • 1.1
    • 1.10
    • 1.10.1
    • 1.10.2
    • 1.10.3
    • 1.10.4
    • 1.11
    • 1.12
    • 1.13
    • 1.13.1
    • 1.14
    • 1.15
    • 1.15.1
    • 1.16
    • 1.17
    • 1.18
    • 1.18.1
    • 1.19
    • 1.19.1
    • 1.2
    • 1.2.1
    • 1.2.2
    • 1.20
    • 1.21
    • 1.21.1
    • 1.22
    • 1.23
    • 1.24
    • 1.24.1
    • 1.24.2
    • 1.24.3
    • 1.25
    • 1.25.1
    • 1.25.10
    • 1.25.11
    • 1.25.2
    • 1.25.3
    • 1.25.4
    • 1.25.5
    • 1.25.6
    • 1.25.7
    • 1.25.8
    • 1.25.9
    • 1.26.0
    • 1.26.1
    • 1.26.10
    • 1.26.11
    • 1.26.12
    • 1.26.13
    • 1.26.14
    • 1.26.15
    • 1.26.16
    • 1.26.17
    • 1.26.18
    • 1.26.19
    • 1.26.2
    • 1.26.20
    • 1.26.3
    • 1.26.4
    • 1.26.5
    • 1.26.6
    • 1.26.7
    • 1.26.8
    • 1.26.9
    • 1.3
    • 1.4
    • 1.5
    • 1.6
    • 1.7
    • 1.7.1
    • 1.8
    • 1.8.2
    • 1.8.3
    • 1.9
    • 1.9.1
    • 2.0.0
    • 2.0.0a1
    • 2.0.0a2
    • 2.0.0a3
    • 2.0.0a4
    • 2.0.1
    • 2.0.2
    • 2.0.3
    • 2.0.4
    • 2.0.5
    • 2.0.6
    • 2.0.7
    • 2.1.0
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 2.3.0
    • 2.4.0
    Affected ranges
    • ECOSYSTEM: < 2.5.0

    Update to 2.5.0

  • python-urllib3 Ubuntu:Pro:16.04:LTS

    Versions
    • 1.11-1
    • 1.12-1
    • 1.13.1-1
    • 1.13.1-2
    • 1.13.1-2ubuntu0.16.04.1
    • 1.13.1-2ubuntu0.16.04.2
    • 1.13.1-2ubuntu0.16.04.3
    • 1.13.1-2ubuntu0.16.04.4
    • 1.13.1-2ubuntu0.16.04.4+esm1
    • 1.13.1-2ubuntu0.16.04.4+esm2
    Affected ranges
    • ECOSYSTEM: < 1.13.1-2ubuntu0.16.04.4+esm3

    Update to 1.13.1-2ubuntu0.16.04.4+esm3

  • python-urllib3 Ubuntu:Pro:18.04:LTS

    Versions
    • 1.21.1-1
    • 1.22-1
    • 1.22-1ubuntu0.18.04.1
    • 1.22-1ubuntu0.18.04.2
    • 1.22-1ubuntu0.18.04.2+esm1
    • 1.22-1ubuntu0.18.04.2+esm2
    Affected ranges
    • ECOSYSTEM: < 1.22-1ubuntu0.18.04.2+esm3

    Update to 1.22-1ubuntu0.18.04.2+esm3

  • python-urllib3 Ubuntu:Pro:20.04:LTS

    Versions
    • 1.24.1-1ubuntu1
    • 1.24.1-1ubuntu2
    • 1.25.8-1
    • 1.25.8-2
    • 1.25.8-2ubuntu0.1
    • 1.25.8-2ubuntu0.2
    • 1.25.8-2ubuntu0.3
    • 1.25.8-2ubuntu0.4
    Affected ranges
    • ECOSYSTEM: < 1.25.8-2ubuntu0.4+esm1

    Update to 1.25.8-2ubuntu0.4+esm1

  • python-pip Ubuntu:22.04:LTS

    Versions
    • 20.3.4-4
    • 21.3.1+dfsg-3
    • 22.0.2+dfsg-1
    • 22.0.2+dfsg-1ubuntu0.1
    • 22.0.2+dfsg-1ubuntu0.2
    • 22.0.2+dfsg-1ubuntu0.3
    • 22.0.2+dfsg-1ubuntu0.4
    • 22.0.2+dfsg-1ubuntu0.5
    Affected ranges
    • ECOSYSTEM: < 22.0.2+dfsg-1ubuntu0.6

    Update to 22.0.2+dfsg-1ubuntu0.6

  • python-urllib3 Ubuntu:22.04:LTS

    Versions
    • 1.26.5-1~exp1
    • 1.26.5-1~exp1ubuntu0.1
    • 1.26.5-1~exp1ubuntu0.2
    Affected ranges
    • ECOSYSTEM: < 1.26.5-1~exp1ubuntu0.3

    Update to 1.26.5-1~exp1ubuntu0.3

  • python-pip Ubuntu:24.04:LTS

    Versions
    • 23.2+dfsg-1
    • 23.3+dfsg-1
    • 24.0+dfsg-1
    • 24.0+dfsg-1ubuntu1
    • 24.0+dfsg-1ubuntu1.1
    Affected ranges
    • ECOSYSTEM: < 24.0+dfsg-1ubuntu1.2

    Update to 24.0+dfsg-1ubuntu1.2

  • python-urllib3 Ubuntu:24.04:LTS

    Versions
    • 1.26.16-1
    • 1.26.18-1
    • 2.0.7-1
    • 2.0.7-1ubuntu0.1
    Affected ranges
    • ECOSYSTEM: < 2.0.7-1ubuntu0.2

    Update to 2.0.7-1ubuntu0.2

Original sources

Check your server →