CVE-2025-50182

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.

References

Affected packages

Debian:11 / python-urllib3

Package

Name: python-urllib3
Purl: pkg:deb/debian/python-urllib3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.26.5-1~exp1

1.26.5-1~exp1+deb11u1

1.26.8-1

1.26.9-1

1.26.12-1

1.26.16-1

1.26.17-1

1.26.18-1

1.26.18-2

2.*

2.0.7-1

2.0.7-2

2.2.3-1

2.2.3-2

2.2.3-3

2.2.3-4

2.3.0-1

2.3.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:12 / python-urllib3

Package

Name: python-urllib3
Purl: pkg:deb/debian/python-urllib3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.26.12-1

1.26.12-1+deb12u1

1.26.16-1

1.26.17-1

1.26.18-1

1.26.18-2

2.*

2.0.7-1

2.0.7-2

2.2.3-1

2.2.3-2

2.2.3-3

2.2.3-4

2.3.0-1

2.3.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Debian:13 / python-urllib3

Package

Name: python-urllib3
Purl: pkg:deb/debian/python-urllib3?arch=source

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.26.12-1

1.26.16-1

1.26.17-1

1.26.18-1

1.26.18-2

2.*

2.0.7-1

2.0.7-2

2.2.3-1

2.2.3-2

2.2.3-3

2.2.3-4

2.3.0-1

2.3.0-2

Ecosystem specific

{
    "urgency": "not yet assigned"
}

Git / github.com/urllib3/urllib3

Affected ranges

Type: GIT
Repo: https://github.com/urllib3/urllib3
Events: Introduced

0 Unknown introduced commit / All previous commits are affected

Fixed

7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f

Affected versions

0.*

0.3

0.3.1

0.4

0.4.1

1.*

1.0

1.0.1

1.0.2

1.1

1.10

1.10.1

1.10.2

1.2

1.2.1

1.25

1.25.1

1.25.2

1.25.3

1.25.4

1.25.5

1.25.6

1.25.7

1.25.8

1.3

1.4

1.5

1.6

1.7

1.7.1

1.8

1.8.1

1.8.2

1.8.3

1.9

1.9.1

2.*

2.0.0

2.0.0a1

2.0.0a2

2.0.0a3

2.0.0a4

2.0.1

2.0.2

2.0.3

2.0.4

2.0.5

2.0.6

2.1.0

2.2.0

2.2.1

2.2.2

2.2.3

2.3.0

2.4.0

v2.*

v2.0.5