CVE-2025-50182 - CVE House

Back to Database

Status published Medium CVE-2025-50182

urllib3 does not control redirects in browsers and Node.js

5.3 CVSS

Vulnerability Description

urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-50182

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from urllib3

View All →

urllib3 Streaming API improperly handles highly compressed data

urllib3 allows an unbounded number of links in the decompression chain

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Proxy-Authorization request header isn't stripped during cross-origin redirects in urllib3

Request body not stripped after redirect in urllib3

Affected Vendor

urllib3

View all reports →

Affected Software

urllib3

Vulnerable Versions:

>= 2.2.0, < 2.5.0

Timeline

Official Publish: June 19th, 2025

Last Modified: December 22nd, 2025

Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1204 User Execution

T1071 Application Layer Protocol

Command and Control

T1189 Drive-by Compromise

T1036 Masquerading

Defense Evasion