CVSS 3.1
6.1 mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NCVE-2025-50182
Medium (6.1) in python urllib3. EPSS 0.6% chance of exploitation in the next 30 days. Fixed in urllib3 2.5.0.
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 48% of CVEs (scores of 2026-10-31)
- CWE
- CWE-601
- Published
- Modified
- Record from
- the NVD, synced
Affected
- python:urllib3
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-48p4-8xcf-vxj5 | PyPI | urllib3 | >=2.2.0 <2.5.0 | 2.5.0 |
| PYSEC-2026-1997 | PyPI | urllib3 | >=2.2.0 <2.5.0 | 2.5.0 |