{"id":"CVE-2025-50182","aliases":["BELL-CVE-2025-50182","DEBIAN-CVE-2025-50182","EUVD-2025-18677","GHSA-48p4-8xcf-vxj5","PYSEC-2026-1997","ROOT-APP-PYPI-CVE-2025-50182","UBUNTU-CVE-2025-50182","USN-7599-1","openSUSE-SU-2025:15283-1"],"status":"published","title":"urllib3 does not control redirects in browsers and Node.js","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00602,"percentile":0.49127,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2025-06-18T17:50:11Z","modified":"2026-11-03T11:15:09Z","fixes":[{"ecosystem":"PyPI","package":"urllib3","fixed_in":["2.5.0"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"python-urllib3","fixed_in":["2.3.0-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-urllib3","fixed_in":["2.3.0-3"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"urllib3","fixed_in":["2.4.0+aikido.7","2.2.2+aikido.4","2.3.0+aikido.7","2.2.3+aikido.5","2.2.1+aikido.5","2.2.3+aikido.6","2.4.0+aikido.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.5.0"}]}]},{"source":"osv","ecosystem":"Alpaquita:23","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.12-r1"}]}]},{"source":"osv","ecosystem":"Alpaquita:stream","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.12-r1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3.0-3"}]}]},{"source":"osv","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.5.0"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.4.0"]},{"source":"osv","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.5.0"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3","2.3.0","2.4.0"]},{"source":"osv","ecosystem":"Root:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.4.0+aikido.7"},{"fixed":"2.2.2+aikido.4"},{"fixed":"2.3.0+aikido.7"},{"fixed":"2.2.3+aikido.5"},{"fixed":"2.2.1+aikido.5"},{"fixed":"2.2.3+aikido.6"},{"fixed":"2.4.0+aikido.8"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.13.1-2ubuntu0.16.04.4+esm3"}]}],"versions":["1.11-1","1.12-1","1.13.1-1","1.13.1-2","1.13.1-2ubuntu0.16.04.1","1.13.1-2ubuntu0.16.04.2","1.13.1-2ubuntu0.16.04.3","1.13.1-2ubuntu0.16.04.4","1.13.1-2ubuntu0.16.04.4+esm1","1.13.1-2ubuntu0.16.04.4+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22-1ubuntu0.18.04.2+esm3"}]}],"versions":["1.21.1-1","1.22-1","1.22-1ubuntu0.18.04.1","1.22-1ubuntu0.18.04.2","1.22-1ubuntu0.18.04.2+esm1","1.22-1ubuntu0.18.04.2+esm2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.8-2ubuntu0.4+esm1"}]}],"versions":["1.24.1-1ubuntu1","1.24.1-1ubuntu2","1.25.8-1","1.25.8-2","1.25.8-2ubuntu0.1","1.25.8-2ubuntu0.2","1.25.8-2ubuntu0.3","1.25.8-2ubuntu0.4"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1~exp1ubuntu0.3"}]}],"versions":["1.26.5-1~exp1","1.26.5-1~exp1ubuntu0.1","1.26.5-1~exp1ubuntu0.2"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.7-1ubuntu0.2"}]}],"versions":["1.26.16-1","1.26.18-1","2.0.7-1","2.0.7-1ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"python","product":"urllib3"},{"vendor":"urllib3","product":"urllib3"}],"references":[{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5","tags":["x_refsource_CONFIRM","Vendor Advisory","advisory","web"]},{"url":"https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50182","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-48p4-8xcf-vxj5","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2025-50182","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50182.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-50182","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3","tags":["package"]},{"url":"https://pypi.org/project/urllib3","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2025-50182","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-50182","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-7599-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-50181","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50181","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-50182","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-50182","title":"urllib3 does not control redirects in browsers and Node.js","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:42:44.921Z","modified":"2025-12-22T18:43:46.779Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:52.526476Z"}],"euvd":[{"id":"EUVD-2025-18677","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:42:44Z","modified":"2025-12-22T18:43:46Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:02.188903Z"}],"ghsa":[{"id":"GHSA-48p4-8xcf-vxj5","title":"urllib3 does not control redirects in browsers and Node.js","description":"urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.\n\nHowever, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.\n\n\n## Affected usages\n\nAny code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.\n\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.\n\n\n## Remediation\n\nIf you use urllib3 in Node.js, upgrade to a patched version of urllib3.\n\nUnfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.","status":"published","published":"2025-06-18T17:50:11Z","modified":"2025-12-22T18:43:37Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:39:14.093341Z"}],"nvd":[{"id":"CVE-2025-50182","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T02:15:17.967Z","modified":"2026-06-17T09:34:48.95Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:11:13.247441Z"}],"osv":[{"id":"BELL-CVE-2025-50182","status":"published","published":"2025-06-19T05:59:59.536347Z","modified":"2026-01-26T09:40:30.490592Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:22.495824Z"},{"id":"CVE-2025-50182","title":"urllib3 does not control redirects in browsers and Node.js","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T01:42:44.921Z","modified":"2026-10-28T02:31:00.132946291Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:44:50.037003Z"},{"id":"DEBIAN-CVE-2025-50182","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.","status":"published","published":"2025-06-19T02:15:17.967Z","modified":"2026-09-01T20:05:53.417939978Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-48p4-8xcf-vxj5","title":"urllib3 does not control redirects in browsers and Node.js","description":"urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.\n\nHowever, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.\n\n\n## Affected usages\n\nAny code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.\n\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.\n\n\n## Remediation\n\nIf you use urllib3 in Node.js, upgrade to a patched version of urllib3.\n\nUnfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.","status":"published","published":"2025-06-18T17:50:11Z","modified":"2026-09-10T03:50:24.821170285Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:36.782754Z"},{"id":"PYSEC-2026-1997","title":"urllib3 does not control redirects in browsers and Node.js","description":"urllib3 [supports](https://urllib3.readthedocs.io/en/2.4.0/reference/contrib/emscripten.html) being used in a Pyodide runtime utilizing the [JavaScript Fetch API](https://developer.mozilla.org/en-US/docs/Web/API/Fetch_API) or falling back on [XMLHttpRequest](https://developer.mozilla.org/en-US/docs/Web/API/XMLHttpRequest). This means you can use Python libraries to make HTTP requests from your browser or Node.js. Additionally, urllib3 provides [a mechanism](https://urllib3.readthedocs.io/en/2.4.0/user-guide.html#retrying-requests) to control redirects.\n\nHowever, the `retries` and `redirect` parameters are ignored with Pyodide; the runtime itself determines redirect behavior.\n\n\n## Affected usages\n\nAny code which relies on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime.\n\n\n## Impact\n\nRedirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.\n\n\n## Remediation\n\nIf you use urllib3 in Node.js, upgrade to a patched version of urllib3.\n\nUnfortunately, browsers provide no suitable way which urllib3 can use: `XMLHttpRequest` provides no control over redirects, the Fetch API returns `opaqueredirect` responses lacking data when redirects are controlled manually. Expect default browser behavior for redirects.","status":"published","published":"2026-07-07T16:02:55.593591Z","modified":"2026-07-07T17:48:15.745179657Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:55.537808Z"},{"id":"ROOT-APP-PYPI-CVE-2025-50182","title":"CVE-2025-50182 in urllib3 - Patched by Root","description":"Root has patched CVE-2025-50182 in the urllib3 package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-11-03T10:56:57Z","modified":"2026-11-03T11:15:09.883358035Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T11:30:16.221977Z"},{"id":"UBUNTU-CVE-2025-50182","description":"urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.","status":"withdrawn","published":"2025-06-19T02:15:00Z","modified":"2026-02-04T03:40:50.619761Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"openSUSE-SU-2025:15283-1","title":"python311-urllib3-2.5.0-1.1 on GA media","description":"These are all security issues fixed in the python311-urllib3-2.5.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-07-03T00:00:00Z","modified":"2026-03-23T04:53:35.621775Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"USN-7599-1","title":"python-urllib3 vulnerabilities","description":"Jacob Sandum discovered that urllib3 handled redirects even when they were\nexplicitly disabled while using the PoolManager. An attacker could possibly\nuse this issue to obtain sensitive information. (CVE-2025-50181)\n\nIllia Volochii discovered that urllib3 incorrectly handled retry and\nredirect parameters when using Node.js. An attacker could possibly use this\nissue to obtain sensitive information. This issue only affected Ubuntu\n25.04. (CVE-2025-50182)","status":"published","published":"2025-06-25T18:48:00Z","modified":"2026-06-25T13:32:30.525274457Z","updated_at":"2026-11-02T16:58:19.988474Z"}]}}