CVE-2025-50181

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

References

Affected packages

Debian:11 / python-urllib3

Package

Name: python-urllib3
Purl: pkg:deb/debian/python-urllib3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.26.5-1~exp1

1.26.5-1~exp1+deb11u1

1.26.8-1

1.26.9-1

1.26.12-1

1.26.16-1

1.26.17-1

1.26.18-1

1.26.18-2

2.*

2.0.7-1

2.0.7-2

2.2.3-1

2.2.3-2

2.2.3-3

2.2.3-4

2.3.0-1

2.3.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / python-urllib3

Package

Name: python-urllib3
Purl: pkg:deb/debian/python-urllib3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.26.12-1

1.26.12-1+deb12u1

1.26.16-1

1.26.17-1

1.26.18-1

1.26.18-2

2.*

2.0.7-1

2.0.7-2

2.2.3-1

2.2.3-2

2.2.3-3

2.2.3-4

2.3.0-1

2.3.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / python-urllib3

Package

Name: python-urllib3
Purl: pkg:deb/debian/python-urllib3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.26.12-1

1.26.16-1

1.26.17-1

1.26.18-1

1.26.18-2

2.*

2.0.7-1

2.0.7-2

2.2.3-1

2.2.3-2

2.2.3-3

2.2.3-4

2.3.0-1

2.3.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/urllib3/urllib3

Affected ranges

Type: GIT
Repo: https://github.com/urllib3/urllib3
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

f05b1329126d5be6de501f9d1e3e36738bc08857

Affected versions

0.*

0.3

0.3.1

0.4

0.4.1

1.*

1.0

1.0.1

1.0.2

1.1

1.10

1.10.1

1.10.2

1.2

1.2.1

1.25

1.25.1

1.25.2

1.25.3

1.25.4

1.25.5

1.25.6

1.25.7

1.25.8

1.3

1.4

1.5

1.6

1.7

1.7.1

1.8

1.8.1

1.8.2

1.8.3

1.9

1.9.1

2.*

2.0.0

2.0.0a1

2.0.0a2

2.0.0a3

2.0.0a4

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.1.0

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

2.4.0

v2.*

v2.0.5