Medium severity · published Jun 19, 2025
CVE-2025-50181
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
6.1
CVSS
0.5%
EPSS
No
On KEV
Description
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 41% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
UR
urllib3 · urllib3
< 2.5.0 · source: vendor, NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-50181
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-50181
Patch
https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
github.com
https://github.com/urllib3/urllib3/releases/tag/2.5.0
Exploit
https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v
More from urllib3
8.1
CVE-2026-97687
urllib3: HTTPS proxy TLS configuration may be ignored or overridden
7.5
CVE-2026-97689
urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory
7.5
CVE-2026-44432
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
7.5
CVE-2026-21441
urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)
7.5
CVE-2025-66471
urllib3 Streaming API improperly handles highly compressed data