{"id":"CVE-2025-50181","aliases":["AZL-64170","AZL-64175","AZL-64218","AZL-64244","AZL-77823","BELL-CVE-2025-50181","CLSA-2025-1759795964","CLSA-2025-1767053571","CLSA-2026-1768176762","CLSA-2026-1769559170","DEBIAN-CVE-2025-50181","DLA-4421-1","EUVD-2025-18908","GHSA-pq67-6m6q-mj2v","MGASA-2025-0281","OESA-2025-1958","OESA-2025-2317","PYSEC-2026-1999","SUSE-SU-2025:02735-1","SUSE-SU-2025:02736-1","SUSE-SU-2025:02985-1","SUSE-SU-2025:20558-1","SUSE-SU-2025:20856-1","UBUNTU-CVE-2025-50181","USN-7599-1","USN-7599-2","openSUSE-SU-2025:15283-1","openSUSE-SU-2025:15284-1","openSUSE-SU-2026:10539-1"],"status":"published","title":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00474,"percentile":0.41424,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2025-06-18T17:50:00Z","modified":"2026-11-05T05:40:51Z","fixes":[{"ecosystem":"PyPI","package":"urllib3","fixed_in":["2.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"python-urllib3","fixed_in":["1.26.19-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-urllib3","fixed_in":["2.0.7-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-virtualenv","fixed_in":["20.26.6-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-pip","fixed_in":["24.2-5"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-virtualenv","fixed_in":["20.36.1-2"],"sources":["osv"]},{"ecosystem":"TuxCare:PyPI","package":"urllib3","fixed_in":["1.26.20.post1+tuxcare","2.0.7.post1+tuxcare"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-urllib3","fixed_in":["1.26.12-1+deb12u2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-urllib3","fixed_in":["2.3.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-urllib3","fixed_in":["2.3.0-3"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-urllib3","fixed_in":["1.26.20-1.1.mga9"],"sources":["osv"]},{"ecosystem":"Mageia:9","package":"python-pip","fixed_in":["23.0.1-1.2.mga9"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-urllib3","fixed_in":["1.26.18-3.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-urllib3","fixed_in":["1.26.18-3.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-urllib3","fixed_in":["1.25.9-12.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-urllib3","fixed_in":["1.26.12-8.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-urllib3","fixed_in":["1.26.12-8.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-urllib3","fixed_in":["1.26.18-3.oe2403"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pip","fixed_in":["21.3.1-10.oe2203sp4"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"python-pip","fixed_in":["23.3.1-5.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pip","fixed_in":["23.3.1-5.oe2403sp1"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS-SP2","package":"python-pip","fixed_in":["23.3.1-5.oe2403sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP4","package":"python-pip","fixed_in":["20.2.2-11.oe2003sp4"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"python-pip","fixed_in":["21.3.1-10.oe2203sp3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-urllib3","fixed_in":["2.0.7-150400.7.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-urllib3","fixed_in":["2.0.7-150400.7.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-urllib3","fixed_in":["2.0.7-150400.7.21.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"python-urllib3","fixed_in":["2.0.7-150400.7.21.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-urllib3","fixed_in":["1.25.10-3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-urllib3","fixed_in":["1.25.10-3.43.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-urllib3","fixed_in":["1.25.10-150300.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-urllib3","fixed_in":["1.25.10-150300.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-urllib3","fixed_in":["1.25.10-150300.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"python-urllib3","fixed_in":["1.25.10-150300.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-urllib3","fixed_in":["1.25.10-150300.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"python-urllib3","fixed_in":["1.25.10-150300.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-urllib3","fixed_in":["1.25.10-150300.4.18.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.0","package":"python-urllib3","fixed_in":["2.1.0-3.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Micro 6.1","package":"python-urllib3","fixed_in":["2.1.0-slfo.1.1_2.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-urllib3","fixed_in":["1.13.1-2ubuntu0.16.04.4+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-urllib3","fixed_in":["1.22-1ubuntu0.18.04.2+esm3"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-urllib3","fixed_in":["1.25.8-2ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-pip","fixed_in":["22.0.2+dfsg-1ubuntu0.6"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"python-urllib3","fixed_in":["1.26.5-1~exp1ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-pip","fixed_in":["24.0+dfsg-1ubuntu1.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:24.04:LTS","package":"python-urllib3","fixed_in":["2.0.7-1ubuntu0.2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-urllib3_1","fixed_in":["1.26.20-3.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.19-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.26.6-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.2-5"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-virtualenv","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.36.1-2"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.12-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.12-r1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.20"},{"fixed":"1.26.20.post1+tuxcare"}]}],"versions":["1.26.20"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.7"},{"fixed":"2.0.7.post1+tuxcare"}]}],"versions":["2.0.7"]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.25.11"},{"fixed":"1.25.11.post3+tuxcare"}]}],"versions":["1.25.11","1.25.11.post2+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.4"},{"fixed":"1.26.4.post4+tuxcare"}]}],"versions":["1.26.4","1.26.4.post1+tuxcare","1.26.4.post2+tuxcare","1.26.4.post3+tuxcare"],"bundled":2},{"source":"osv","ecosystem":"Debian:12","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.12-1+deb12u2"}]}],"versions":["1.26.12-1","1.26.12-1+deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1~exp1+deb11u2"}]}],"versions":["1.26.5-1~exp1","1.26.5-1~exp1+deb11u1"],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}],"versions":["0.2","0.3","0.3.1","0.4.0","0.4.1","1.0","1.0.1","1.0.2","1.1","1.10","1.10.1","1.10.2","1.10.3","1.10.4","1.11","1.12","1.13","1.13.1","1.14","1.15","1.15.1","1.16","1.17","1.18","1.18.1","1.19","1.19.1","1.2","1.2.1","1.2.2","1.20","1.21","1.21.1","1.22","1.23","1.24","1.24.1","1.24.2","1.24.3","1.25","1.25.1","1.25.10","1.25.11","1.25.2","1.25.3","1.25.4","1.25.5","1.25.6","1.25.7","1.25.8","1.25.9","1.26.0","1.26.1","1.26.10","1.26.11","1.26.12","1.26.13","1.26.14","1.26.15","1.26.16","1.26.17","1.26.18","1.26.19","1.26.2","1.26.20","1.26.3","1.26.4","1.26.5","1.26.6","1.26.7","1.26.8","1.26.9","1.3","1.4","1.5","1.6","1.7","1.7.1","1.8","1.8.2","1.8.3","1.9","1.9.1","2.0.0","2.0.0a1","2.0.0a2","2.0.0a3","2.0.0a4","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.4.0"]},{"source":"osv","ecosystem":"Mageia:9","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.20-1.1.mga9"}]}]},{"source":"osv","ecosystem":"Mageia:9","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.0.1-1.2.mga9"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-3.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-3.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.9-12.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.12-8.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.12-8.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.18-3.oe2403"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.1-10.oe2203sp4"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP1","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-5.oe2403sp1"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS-SP2","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"23.3.1-5.oe2403sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.2.2-11.oe2003sp4"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.1-10.oe2203sp3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0"}]}],"versions":["0.2","0.3","0.3.1","0.4.0","0.4.1","1.0","1.0.1","1.0.2","1.1","1.10","1.10.1","1.10.2","1.10.3","1.10.4","1.11","1.12","1.13","1.13.1","1.14","1.15","1.15.1","1.16","1.17","1.18","1.18.1","1.19","1.19.1","1.2","1.2.1","1.2.2","1.20","1.21","1.21.1","1.22","1.23","1.24","1.24.1","1.24.2","1.24.3","1.25","1.25.1","1.25.10","1.25.11","1.25.2","1.25.3","1.25.4","1.25.5","1.25.6","1.25.7","1.25.8","1.25.9","1.26.0","1.26.1","1.26.10","1.26.11","1.26.12","1.26.13","1.26.14","1.26.15","1.26.16","1.26.17","1.26.18","1.26.19","1.26.2","1.26.20","1.26.3","1.26.4","1.26.5","1.26.6","1.26.7","1.26.8","1.26.9","1.3","1.4","1.5","1.6","1.7","1.7.1","1.8","1.8.2","1.8.3","1.9","1.9.1","2.0.0","2.0.0a1","2.0.0a2","2.0.0a3","2.0.0a4","2.0.1","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.7","2.1.0","2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.4.0"]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP6","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Python 3 15 SP7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.21.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-150400.7.21.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server LTSS Extended Security 12 SP5","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-3.43.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-150300.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-150300.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-150300.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP6","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-150300.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Basesystem 15 SP7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-150300.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.1","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-150300.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.2","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.10-150300.4.18.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.0","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-3.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Micro 6.1","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.0-slfo.1.1_2.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-2ubuntu0.16.04.4+esm3"}]}],"versions":["1.11-1","1.12-1","1.13.1-1","1.13.1-2","1.13.1-2ubuntu0.16.04.1","1.13.1-2ubuntu0.16.04.2","1.13.1-2ubuntu0.16.04.3","1.13.1-2ubuntu0.16.04.4","1.13.1-2ubuntu0.16.04.4+esm1","1.13.1-2ubuntu0.16.04.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-1ubuntu0.18.04.2+esm3"}]}],"versions":["1.21.1-1","1.22-1","1.22-1ubuntu0.18.04.1","1.22-1ubuntu0.18.04.2","1.22-1ubuntu0.18.04.2+esm1","1.22-1ubuntu0.18.04.2+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.8-2ubuntu0.4+esm1"}]}],"versions":["1.24.1-1ubuntu1","1.24.1-1ubuntu2","1.25.8-1","1.25.8-2","1.25.8-2ubuntu0.1","1.25.8-2ubuntu0.2","1.25.8-2ubuntu0.3","1.25.8-2ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.2+dfsg-1ubuntu0.6"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1","22.0.2+dfsg-1ubuntu0.2","22.0.2+dfsg-1ubuntu0.3","22.0.2+dfsg-1ubuntu0.4","22.0.2+dfsg-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1~exp1ubuntu0.3"}]}],"versions":["1.26.5-1~exp1","1.26.5-1~exp1ubuntu0.1","1.26.5-1~exp1ubuntu0.2"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0+dfsg-1ubuntu1.2"}]}],"versions":["23.2+dfsg-1","23.3+dfsg-1","24.0+dfsg-1","24.0+dfsg-1ubuntu1","24.0+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1ubuntu0.2"}]}],"versions":["1.26.16-1","1.26.18-1","2.0.7-1","2.0.7-1ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-2ubuntu0.16.04.4+esm3"}]}],"versions":["1.11-1","1.12-1","1.13.1-1","1.13.1-2","1.13.1-2ubuntu0.16.04.1","1.13.1-2ubuntu0.16.04.2","1.13.1-2ubuntu0.16.04.3","1.13.1-2ubuntu0.16.04.4","1.13.1-2ubuntu0.16.04.4+esm1","1.13.1-2ubuntu0.16.04.4+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-1ubuntu0.18.04.2+esm3"}]}],"versions":["1.21.1-1","1.22-1","1.22-1ubuntu0.18.04.1","1.22-1ubuntu0.18.04.2","1.22-1ubuntu0.18.04.2+esm1","1.22-1ubuntu0.18.04.2+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.8-2ubuntu0.4+esm1"}]}],"versions":["1.24.1-1ubuntu1","1.24.1-1ubuntu2","1.25.8-1","1.25.8-2","1.25.8-2ubuntu0.1","1.25.8-2ubuntu0.2","1.25.8-2ubuntu0.3","1.25.8-2ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1~exp1ubuntu0.3"}]}],"versions":["1.26.5-1~exp1","1.26.5-1~exp1ubuntu0.1","1.26.5-1~exp1ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1ubuntu0.2"}]}],"versions":["1.26.16-1","1.26.18-1","2.0.7-1","2.0.7-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.0.2+dfsg-1ubuntu0.6"}]}],"versions":["20.3.4-4","21.3.1+dfsg-3","22.0.2+dfsg-1","22.0.2+dfsg-1ubuntu0.1","22.0.2+dfsg-1ubuntu0.2","22.0.2+dfsg-1ubuntu0.3","22.0.2+dfsg-1ubuntu0.4","22.0.2+dfsg-1ubuntu0.5"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"24.0+dfsg-1ubuntu1.2"}]}],"versions":["23.2+dfsg-1","23.3+dfsg-1","24.0+dfsg-1","24.0+dfsg-1ubuntu1","24.0+dfsg-1ubuntu1.1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-urllib3_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.20-3.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"oci-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.76.2-1.1"}]}],"bundled":7}],"products":[{"vendor":"python","product":"urllib3"},{"vendor":"urllib3","product":"urllib3"}],"references":[{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v","tags":["x_refsource_CONFIRM","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-pq67-6m6q-mj2v","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-50181","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50181.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-50181","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2025-0281.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=34401","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7599-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-7599-2","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-1958","tags":["advisory"]},{"url":"https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2025-2317","tags":["advisory"]},{"url":"https://pypi.org/project/urllib3","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502735-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244925","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50181","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502736-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502985-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520558-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202520856-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-50181","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-50181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2025-50182","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50182","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-37891","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-47273","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-66418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-21441","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-26007","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-50181","title":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:08:00.34Z","modified":"2025-12-22T18:44:17.668Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:52.526476Z"}],"euvd":[{"id":"EUVD-2025-18908","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:08:00Z","modified":"2025-12-22T18:44:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:02.188903Z"}],"ghsa":[{"id":"GHSA-pq67-6m6q-mj2v","title":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","description":"urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:\n\n```python\nresp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False)\nprint(resp.status)\n# 302\n```\n\nHowever, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:\n\n```python\nimport urllib3\n\nhttp = urllib3.PoolManager(retries=0)  # should raise MaxRetryError on redirect\nhttp = urllib3.PoolManager(retries=urllib3.Retry(redirect=0))  # equivalent to the above\nhttp = urllib3.PoolManager(retries=False)  # should return the first response\n\nresp = http.request(\"GET\", \"https://httpbin.org/redirect/1\")\n```\n\nHowever, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects.\n\n## Affected usages\n\nPassing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.\n\nBy default, requests and botocore users are not affected.\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.\n\n## Remediation\n\nYou can remediate this vulnerability with the following steps:\n\n * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.\n * Disable redirects at the `request()` level instead of the `PoolManager()` level.","status":"published","published":"2025-06-18T17:50:00Z","modified":"2025-12-22T21:33:24Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:39:14.093341Z"}],"nvd":[{"id":"CVE-2025-50181","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:15:24.453Z","modified":"2026-06-17T09:34:48.843Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:11:13.247441Z"}],"osv":[{"id":"BELL-CVE-2025-50181","status":"published","published":"2025-06-20T06:00:01.989358Z","modified":"2026-01-26T09:40:29.007489Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-50181","title":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:08:00.34Z","modified":"2026-10-28T02:31:01.747415445Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-50181","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:15:24.453Z","modified":"2026-09-01T20:05:53.426016605Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-pq67-6m6q-mj2v","title":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","description":"urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:\n\n```python\nresp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False)\nprint(resp.status)\n# 302\n```\n\nHowever, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:\n\n```python\nimport urllib3\n\nhttp = urllib3.PoolManager(retries=0)  # should raise MaxRetryError on redirect\nhttp = urllib3.PoolManager(retries=urllib3.Retry(redirect=0))  # equivalent to the above\nhttp = urllib3.PoolManager(retries=False)  # should return the first response\n\nresp = http.request(\"GET\", \"https://httpbin.org/redirect/1\")\n```\n\nHowever, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects.\n\n## Affected usages\n\nPassing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.\n\nBy default, requests and botocore users are not affected.\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.\n\n## Remediation\n\nYou can remediate this vulnerability with the following steps:\n\n * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.\n * Disable redirects at the `request()` level instead of the `PoolManager()` level.","status":"published","published":"2025-06-18T17:50:00Z","modified":"2026-09-10T03:50:25.299291456Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:53.700556Z"},{"id":"OESA-2025-1958","title":"python-urllib3 security update","description":"HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more.\r\n\r\nSecurity Fix(es):\n\nurllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)","status":"published","published":"2025-08-01T11:09:02Z","modified":"2026-08-18T01:18:56.477948882Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:43.127925Z"},{"id":"OESA-2025-2317","title":"python-pip security update","description":"pip is the package installer for Python. You can use pip to install packages from the Python Package Index and other indexes. %global bashcompdir %(b=$(pkg-config --variable=completionsdir bash-completion 2\u0026amp;gt;/dev/null); echo ${b:-/bash_completion.d}) Name:           python-pip Version:        23.3.1 Release:        3 Summary:        A tool for installing and managing Python packages License:        MIT and Python and ASL 2.0 and BSD and ISC and LGPLv2 and MPLv2.0 and (ASL 2.0 or BSD) URL:            http://www.pip-installer.org Source0:          Source1:        pip.loongarch.conf BuildArch:      noarch Patch1:         remove-existing-dist-only-if-path-conflicts. Patch6000:      dummy-certifi.patch Patch6001:      backport-CVE-2023-45803-Made-body-stripped-from-HTTP-requests.patch Patch6002:      backport-CVE-2024-37891-Strip-Proxy-Authorization-header-on-redirects.patch\r\n\r\nSecurity Fix(es):\n\nurllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)","status":"published","published":"2025-09-19T11:09:23Z","modified":"2026-08-18T01:19:11.123983574Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:44.957082Z"},{"id":"PYSEC-2026-1999","title":"urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation","description":"urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:\n\n```python\nresp = urllib3.request(\"GET\", \"https://httpbin.org/redirect/1\", redirect=False)\nprint(resp.status)\n# 302\n```\n\nHowever, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:\n\n```python\nimport urllib3\n\nhttp = urllib3.PoolManager(retries=0)  # should raise MaxRetryError on redirect\nhttp = urllib3.PoolManager(retries=urllib3.Retry(redirect=0))  # equivalent to the above\nhttp = urllib3.PoolManager(retries=False)  # should return the first response\n\nresp = http.request(\"GET\", \"https://httpbin.org/redirect/1\")\n```\n\nHowever, the `retries` parameter is currently ignored, which means all the above examples don't disable redirects.\n\n## Affected usages\n\nPassing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.\n\nBy default, requests and botocore users are not affected.\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.\n\n## Remediation\n\nYou can remediate this vulnerability with the following steps:\n\n * Upgrade to a patched version of urllib3. If your organization would benefit from the continued support of urllib3 1.x, please contact [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com) to discuss sponsorship or contribution opportunities.\n * Disable redirects at the `request()` level instead of the `PoolManager()` level.","status":"published","published":"2026-07-07T16:02:55.519678Z","modified":"2026-07-07T17:47:54.161376347Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"UBUNTU-CVE-2025-50181","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:15:00Z","modified":"2026-02-04T03:02:04.618313Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"AZL-64170","title":"CVE-2025-50181 affecting package python-urllib3 for versions less than 1.26.19-2","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:15:24Z","modified":"2026-04-21T04:32:18.847259Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-64175","title":"CVE-2025-50181 affecting package python-urllib3 for versions less than 2.0.7-2","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:15:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"AZL-64218","title":"CVE-2025-50181 affecting package python-virtualenv for versions less than 20.26.6-2","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:15:24Z","modified":"2026-04-21T04:32:20.195042Z","updated_at":"2026-11-02T15:28:07.805289Z"},{"id":"AZL-64244","title":"CVE-2025-50181 affecting package python-pip for versions less than 24.2-5","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:15:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:21.518778Z"},{"id":"AZL-77823","title":"CVE-2025-50181 affecting package python-virtualenv for versions less than 20.36.1-2","description":"urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:15:24Z","modified":"2026-11-05T05:40:51Z","updated_at":"2026-11-05T16:41:24.626116Z"},{"id":"CLSA-2025-1759795964","title":"TuxCare security update for urllib3 (1 CVE)","description":"TuxCare rebuilt urllib3 to address 1 CVE. Fixed in 1.26.20.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:00.934355203Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"CLSA-2025-1767053571","title":"TuxCare security update for urllib3 (1 CVE)","description":"TuxCare rebuilt urllib3 to address 1 CVE. Fixed in 2.0.7.post1+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:00.730612023Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1768176762","title":"TuxCare security update for urllib3 (2 CVEs)","description":"TuxCare rebuilt urllib3 to address 2 CVEs. Fixed in 1.25.11.post3+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:47:58.743045373Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"CLSA-2026-1769559170","title":"TuxCare security update for urllib3 (2 CVEs)","description":"TuxCare rebuilt urllib3 to address 2 CVEs. Fixed in 1.26.4.post4+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:47:41.940041542Z","updated_at":"2026-11-02T15:43:42.847264Z"},{"id":"DLA-4421-1","title":"python-urllib3 - security update","status":"published","published":"2025-12-26T00:00:00Z","modified":"2025-12-26T12:14:55.267207Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"MGASA-2025-0281","title":"Updated python-urllib3 \u0026 python-pip packages fix security vulnerability","description":"Urllib3 redirects are not disabled when retries are disabled on\nPoolManager instantiation. (CVE-2025-50181)\n","status":"published","published":"2025-11-12T21:29:34Z","modified":"2026-04-16T04:44:28.764467058Z","updated_at":"2026-11-02T15:49:43.178336Z"},{"id":"openSUSE-SU-2025:15283-1","title":"python311-urllib3-2.5.0-1.1 on GA media","description":"These are all security issues fixed in the python311-urllib3-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:35.621775Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2025:15284-1","title":"python311-urllib3_1-1.26.20-3.1 on GA media","description":"These are all security issues fixed in the python311-urllib3_1-1.26.20-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:35.645968Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"openSUSE-SU-2026:10539-1","title":"oci-cli-3.76.2-1.1 on GA media","description":"These are all security issues fixed in the oci-cli-3.76.2-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-13T00:00:00Z","modified":"2026-04-14T08:28:13.660624Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"SUSE-SU-2025:02735-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2025-50181: Pool managers now properly control redirects when retries is passed. (bsc#1244925)\n","status":"published","published":"2025-08-08T08:06:11Z","modified":"2026-02-04T03:27:23.604121Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02736-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2025-50181: Pool managers now properly control redirects when retries is passed. (bsc#1244925)\n","status":"published","published":"2025-08-08T08:06:29Z","modified":"2026-02-04T04:23:23.892011Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02985-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2025-50181: Pool managers now properly control redirects when retries is passed. (bsc#1244925)\n","status":"published","published":"2025-08-25T13:55:10Z","modified":"2026-03-23T04:49:50.79373Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:20558-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2025-50181: * Pool managers now properly control redirects when retries is passed (GHSA-pq67-6m6q-mj2v, bsc#1244925)\n\n","status":"published","published":"2025-08-14T09:26:49Z","modified":"2026-03-23T04:48:19.243614Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"SUSE-SU-2025:20856-1","title":"Security update for python-urllib3","description":"This update for python-urllib3 fixes the following issues:\n\n- CVE-2025-50181: Pool managers now properly control redirects when retries is passed (bsc#1244925)\n","status":"published","published":"2025-10-14T13:15:37Z","modified":"2026-03-23T04:51:03.101536Z","updated_at":"2026-11-02T15:53:59.92114Z"},{"id":"USN-7599-1","title":"python-urllib3 vulnerabilities","description":"Jacob Sandum discovered that urllib3 handled redirects even when they were\nexplicitly disabled while using the PoolManager. An attacker could possibly\nuse this issue to obtain sensitive information. (CVE-2025-50181)\n\nIllia Volochii discovered that urllib3 incorrectly handled retry and\nredirect parameters when using Node.js. An attacker could possibly use this\nissue to obtain sensitive information. This issue only affected Ubuntu\n25.04. (CVE-2025-50182)","status":"published","published":"2025-06-25T18:48:00Z","modified":"2026-06-25T13:32:30.525274457Z","updated_at":"2026-11-02T16:58:19.988474Z"},{"id":"USN-7599-2","title":"python-pip vulnerability","description":"USN-7599-1 fixed vulnerabilities in python-urllib3. This update provides\nthe corresponding update for python-pip for CVE-2025-50181.\n\nOriginal advisory details:\n\nJacob Sandum discovered that urllib3 handled redirects even when they were\nexplicitly disabled while using the PoolManager. An attacker could possibly\nuse this issue to obtain sensitive information. (CVE-2025-50181)\n\nIllia Volochii discovered that urllib3 incorrectly handled retry and\nredirect parameters when using Node.js. An attacker could possibly use this\nissue to obtain sensitive information. This issue only affected Ubuntu\n25.04. (CVE-2025-50182)\n","status":"published","published":"2025-06-26T14:19:38Z","modified":"2026-02-10T04:49:28Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}