Skip to content
OpenAdvisories
Medium · 5.3 CVE-2025-50181 EUVD-2025-18908GHSA-pq67-6m6q-mj2vPYSEC-2026-1999

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Published Jun 19, 2025 · Updated Dec 22, 2025 · Assigned by GitHub_M

Vendor: urllib3 Product: urllib3 Package: airflow-3 Package: airflow-3-bitnami-compat Package: airflow-3-compat Package: airflow-3-iamguarded-compat Package: az Package: az-iamguarded-compat Package: confluent-docker-utils Package: dask-gateway Package: dask-kubernetes Package: datadog-agent-7.72 Package: datadog-agent-7.72-core-integrations Package: datadog-agent-7.73 Package: datadog-agent-7.73-core-integrations Package: datadog-agent-7.77 Package: datadog-agent-7.77-core-integrations Package: emissary Package: emissary-apiext Package: emissary-oci-entrypoint Package: ggshield Package: gitlab-cng-18.2 Package: jupyter-base-notebook Package: jupyter-docker-base Package: jupyter-docker-stacks Package: jwt-tool Package: k8s-sidecar Package: katib-earlystopping Package: katib-suggestion-hyperband Package: katib-suggestion-hyperopt Package: katib-suggestion-nas-darts Package: katib-suggestion-optuna-enas Package: katib-suggestion-pbt-enas Package: katib-suggestion-skopt-enas Package: kserve Package: kserve-agent Package: kserve-agent-compat Package: kserve-manager Package: kserve-manager-compat Package: kserve-qpext Package: kserve-qpext-compat Package: kserve-router Package: kserve-router-compat Package: kserve-storage-controller Package: kubeflow-jupyter-web-app Package: kubeflow-pipelines Package: kubeflow-pipelines-apiserver Package: kubeflow-pipelines-cache_server Package: kubeflow-pipelines-cache-deployer Package: kubeflow-pipelines-cache-deployer-compat Package: kubeflow-pipelines-frontend Package: kubeflow-pipelines-metadata-envoy-config Package: kubeflow-pipelines-metadata-writer Package: kubeflow-pipelines-metadata-writer-compat Package: kubeflow-pipelines-persistence_agent Package: kubeflow-pipelines-scheduledworkflow Package: kubeflow-pipelines-viewer-crd-controller Package: py3-cassandra-medusa Package: py3.10-ambassador Package: py3.10-pip-base Package: py3.10-pipenv Package: py3.11-ambassador Package: py3.11-pip-base Package: py3.11-pipenv Package: py3.12-ambassador Package: py3.12-pip-base Package: py3.12-pipenv Package: py3.13-ambassador Package: py3.13-pip-base Package: py3.13-pipenv Package: py3.14-pip-base Package: pypy-3.10 Package: pypy-3.11 Package: python-pip Package: python-pip Package: python-urllib3 Package: python-urllib3 Package: python-urllib3 Package: python-virtualenv Package: urllib3 Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: PyPI Ecosystem: Ubuntu Ecosystem: Wolfi

Description

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

Affected products

VendorProductAffectedFixed
urllib3 urllib3 < 2.5.0 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 python-urllib3 2.3.0-3 —
Debian 13 python-urllib3 2.3.0-3 —
Debian 12 python-urllib3 1.26.12-1+deb12u2 —
Debian 11 python-urllib3 1.26.5-1~exp1+deb11u2 DLA-4421-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 24.04 LTS python-pip 24.0+dfsg-1ubuntu1.2 USN-7599-2
Ubuntu 24.04 LTS python-urllib3 2.0.7-1ubuntu0.2 USN-7599-1
Ubuntu 22.04 LTS python-pip 22.0.2+dfsg-1ubuntu0.6 USN-7599-2
Ubuntu 22.04 LTS python-urllib3 1.26.5-1~exp1ubuntu0.3 USN-7599-1
Show 3 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS python-urllib3 1.25.8-2ubuntu0.4+esm1 USN-7599-1
Ubuntu Pro 18.04 LTS python-urllib3 1.22-1ubuntu0.18.04.2+esm3 USN-7599-1
Ubuntu Pro 16.04 LTS python-urllib3 1.13.1-2ubuntu0.16.04.4+esm3 USN-7599-1

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP7 python-urllib3 1.25.10-150300.4.18.1 SUSE-SU-2025:02985-1
SLES 15 SP6 python-urllib3 1.25.10-150300.4.18.1 SUSE-SU-2025:02985-1
SLES 15 SP4 python-urllib3 2.0.7-150400.7.21.1 SUSE-SU-2025:02735-1
SLES 12 SP5 python-urllib3 1.25.10-3.43.1 SUSE-SU-2025:02736-1
SLES 12 python-urllib3 1.25.10-3.43.1 SUSE-SU-2025:02736-1
Show 8 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES 3 python-urllib3 2.0.7-150400.7.21.1 SUSE-SU-2025:02735-1
SLE Micro 6.1 python-urllib3 2.1.0-slfo.1.1_2.1 SUSE-SU-2025:20856-1
SLE Micro 6.0 python-urllib3 2.1.0-3.1 SUSE-SU-2025:20558-1
SLE Micro 5.5 python-urllib3 1.25.10-150300.4.18.1 SUSE-SU-2025:02985-1
SLE Micro 5.4 python-urllib3 1.25.10-150300.4.18.1 SUSE-SU-2025:02985-1
SLE Micro 5.3 python-urllib3 1.25.10-150300.4.18.1 SUSE-SU-2025:02985-1
SLE Micro 5.2 python-urllib3 1.25.10-150300.4.18.1 SUSE-SU-2025:02985-1
SLE Micro 5.1 python-urllib3 1.25.10-150300.4.18.1 SUSE-SU-2025:02985-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed oci-cli 3.76.2-1.1 openSUSE-SU-2026:10539-1
openSUSE Tumbleweed python-urllib3 2.5.0-1.1 openSUSE-SU-2025:15283-1
openSUSE Tumbleweed python-urllib3_1 1.26.20-3.1 openSUSE-SU-2025:15284-1
openSUSE Leap 15.6 python-urllib3 2.0.7-150400.7.21.1 SUSE-SU-2025:02735-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2023 python3-pip +1 21.3.1-2.amzn2023.0.13 ALAS2023-2025-1095
Amazon Linux 2023 python3-urllib3 1.25.10-5.amzn2023.0.5 ALAS2023-2025-1059
Amazon Linux 2023 python3.11-pip +1 22.3.1-2.amzn2023.0.7 ALAS2023-2025-1097
Amazon Linux 2023 python3.12-pip +1 23.2.1-4.amzn2023.0.5 ALAS2023-2025-1096
Amazon Linux 2 python-urllib3 1.25.9-1.amzn2.0.5 ALAS2-2025-2915
Amazon Linux 2 python2-pip +2 20.2.2-1.amzn2.0.12 ALAS2-2025-2935
Amazon Linux 2 python3-urllib3 1.25.6-2.amzn2.0.3 ALAS2-2025-2916

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 python-pip 24.2-5 —
Azure Linux 3 python-urllib3 2.0.7-2 —
Azure Linux 3 python-virtualenv 20.36.1-2 —
Azure Linux 2 (CBL-Mariner) python-urllib3 1.26.19-2 —
Azure Linux 2 (CBL-Mariner) python-virtualenv 20.26.6-2 —

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling airflow-3 +3 3.0.2-r2 —
Wolfi rolling az +1 2.74.0-r3 —
Wolfi rolling confluent-docker-utils 0.0.162-r1 —
Wolfi rolling dask-gateway 2025.4.0-r7 —
Wolfi rolling dask-kubernetes 2025.4.3-r4 —
Wolfi rolling datadog-agent-7.72 +1 7.72.4-r22 —
Wolfi rolling datadog-agent-7.73 +1 7.73.3-r13 —
Wolfi rolling datadog-agent-7.77 +1 7.77.3-r6 —
Wolfi rolling emissary +6 3.10.0-r6 —
Wolfi rolling ggshield 1.43.0-r0 —
Wolfi rolling gitlab-cng-18.2 No fix yet —
Wolfi rolling jupyter-base-notebook 7.4.3-r2 —
Wolfi rolling jupyter-docker-base +1 999.9.9_git20260925-r0 —
Wolfi rolling jwt-tool 2.3.0-r2 —
Wolfi rolling k8s-sidecar 1.30.5-r0 —
Wolfi rolling katib-earlystopping 0.19.0-r3 —
Wolfi rolling katib-suggestion-hyperopt +5 0.19.0-r13 —
Wolfi rolling kserve +9 0.16.0-r6 —
Wolfi rolling kubeflow-jupyter-web-app 1.10.0-r5 —
Wolfi rolling kubeflow-pipelines +11 2.5.0-r4 —
Wolfi rolling py3-cassandra-medusa 0.27.0-r1 —
Wolfi rolling py3.10-pip-base +4 26.1.1-r0 —
Wolfi rolling py3.10-pipenv +3 2026.6.0-r0 —
Wolfi rolling pypy-3.10 7.3.19-r16 —
Wolfi rolling pypy-3.11 7.3.22-r0 —

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI urllib3 < 2.5.0 2.5.0 GHSA-pq67-6m6q-mj2v

Advisories 24

References