CVE-2025-50182

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-50182
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-50182.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-50182
Aliases
Downstream
BELL (1)
CGA (178)
DEBIAN (1)
ECHO (1)
MINI (6)
openSUSE (1)
ROOT (1)
UBUNTU (1)
Related
Published
2025-06-19T01:42:44Z
Modified
2026-10-21T02:30:19Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
urllib3 does not control redirects in browsers and Node.js
Details

urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-601"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50182.json"
}
References

Affected packages

Git / github.com/urllib3/urllib3

Affected ranges

Type
GIT
Repo
https://github.com/urllib3/urllib3
Events
Introduced
04df048cf4b1c3790c56e26c659db764aad62d6f
Fixed
aaab4eccc10c965897540b21e15f11859d0b62e7
Fixed
7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f
Database specific
Show details 
{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2.2.0"
                },
                {
                    "fixed":  "2.5.0"
                }
            ],
            "source":  "CPE_RANGE"
        },
        {
            "range":  [
                {
                    "fixed":  "7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "2.5.0",
            "range":  [
                {
                    "fixed":  "aaab4eccc10c965897540b21e15f11859d0b62e7"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

2.*
2.2.0
2.2.1
2.2.2
2.2.3
2.3.0
2.4.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-50182.json"