CVE-2025-50181

· MEDIUMModified

← All CVEs

CVSS v3.1

5.3

EPSS

0.41%

Published

Jun 18, 2025

Modified

Dec 22, 2025

Public PoC / Exploit (1)

All weaponized →

TrickestTrickest PoC index

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Weaknesses (CWE)

CWE-601

Affected Products (1)

python · urllib3 (up to 2.5.0)vulnerable

References (3)

https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857

Patch

https://github.com/urllib3/urllib3/releases/tag/2.5.0

https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v

ExploitVendor Advisory

KEV Catalog EPSS Scores Vendors All CVEs