Description
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| urllib3 | urllib3 | >= 2.2.0, < 2.5.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-urllib3 | 2.3.0-3 | — |
| Debian 13 | python-urllib3 | 2.3.0-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 24.04 LTS | python-urllib3 | 2.0.7-1ubuntu0.2 | USN-7599-1 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.3 | USN-7599-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm1 | USN-7599-1 |
| Ubuntu Pro 18.04 LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm3 | USN-7599-1 |
| Ubuntu Pro 16.04 LTS | python-urllib3 | 1.13.1-2ubuntu0.16.04.4+esm3 | USN-7599-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-urllib3 | 2.5.0-1.1 | openSUSE-SU-2025:15283-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | airflow-3 +3 | 3.0.2-r2 | — |
| Wolfi rolling | az +1 | 2.74.0-r3 | — |
| Wolfi rolling | confluent-docker-utils | 0.0.162-r1 | — |
| Wolfi rolling | dask-gateway +1 | 2025.4.0-r1 | — |
| Wolfi rolling | dask-kubernetes | 2025.4.3-r4 | — |
| Wolfi rolling | emissary +6 | 3.10.0-r6 | — |
| Wolfi rolling | ggshield | 1.43.0-r0 | — |
| Wolfi rolling | jupyter-base-notebook | 7.4.3-r2 | — |
| Wolfi rolling | jupyter-docker-base +1 | 999.9.9_git20260925-r0 | — |
| Wolfi rolling | jwt-tool | 2.3.0-r2 | — |
| Wolfi rolling | k8s-sidecar | 1.30.5-r0 | — |
| Wolfi rolling | katib-earlystopping | 0.19.0-r0 | — |
| Wolfi rolling | kserve +9 | 0.16.0-r6 | — |
| Wolfi rolling | kubeflow-jupyter-web-app | 1.10.0-r5 | — |
| Wolfi rolling | kubeflow-pipelines +11 | 2.5.0-r4 | — |
| Wolfi rolling | py3-cassandra-medusa | 0.26.0-r0 | — |
| Wolfi rolling | py3-pipenv +9 | 2025.0.3-r0 | — |
| Wolfi rolling | py3.10-pip-base | 25.3-r1 | — |
| Wolfi rolling | pypy-3.10 +1 | 7.3.19-r10 | — |
| Wolfi rolling | pypy-3.11 +1 | 7.3.19-r37 | — |
| Wolfi rolling | reflex | 0.8.0-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | >= 2.2.0, < 2.5.0 | 2.5.0 | GHSA-48p4-8xcf-vxj5 |
Advisories 5
- USN-7599-1 python-urllib3 vulnerabilities Ubuntu Security Notices (USN) · Jun 25, 2026
- openSUSE-SU-2025:15283-1 python311-urllib3-2.5.0-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2534 IBM Business Automation Workflow: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 26, 2025
- WID-SEC-2025-2424 IBM Rational Team Concert: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 28, 2025
- WID-SEC-2025-2154 IBM InfoSphere Information Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 29, 2025