CVE-2025-50181 - CVE House

Back to Database

Status published Medium CVE-2025-50181

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

5.3 CVSS

Vulnerability Description

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-50181

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from urllib3

View All →

urllib3 Streaming API improperly handles highly compressed data

urllib3 allows an unbounded number of links in the decompression chain

urllib3 does not control redirects in browsers and Node.js

Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

Request body not stripped after redirect in urllib3

Affected Vendor

urllib3

View all reports →

Affected Software

urllib3

Vulnerable Versions:

< 2.5.0

Timeline

Official Publish: June 19th, 2025

Last Modified: December 22nd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1204 User Execution

T1071 Application Layer Protocol

Command and Control

T1189 Drive-by Compromise

T1036 Masquerading

Defense Evasion