Summary
Jacob Sandum discovered that urllib3 handled redirects even when they were
explicitly disabled while using the PoolManager. An attacker could possibly
use this issue to obtain sensitive information. (CVE-2025-50181)
Illia Volochii discovered that urllib3 incorrectly handled retry and
redirect parameters when using Node.js. An attacker could possibly use this
issue to obtain sensitive information. This issue only affected Ubuntu
25.04. (CVE-2025-50182)
Fixed packages 5
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.3 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-urllib3 | 2.0.7-1ubuntu0.2 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python-urllib3 | 1.13.1-2ubuntu0.16.04.4+esm3 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm3 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm1 |
Vulnerabilities 2
-
Medium 5.3
urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are …
-
Medium 5.3
urllib3 does not control redirects in browsers and Node.js
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling…