CVE-2025-50181
Fixed in a distro release EPSS <1%CVSS 5.3
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
Products: urllib3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | urllib3 | 2.5.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2 | python-pip-wheel | 20.2.2-1.amzn2.0.12 |
| Amazon Linux 2 | python-urllib3 | 1.25.9-1.amzn2.0.5 |
| Amazon Linux 2 | python2-pip | 20.2.2-1.amzn2.0.12 |
| Amazon Linux 2 | python3-pip | 20.2.2-1.amzn2.0.12 |
| Amazon Linux 2 | python3-urllib3 | 1.25.6-2.amzn2.0.3 |
| Amazon Linux 2023 | python3-pip | 21.3.1-2.amzn2023.0.13 |
| Amazon Linux 2023 | python3-pip-wheel | 21.3.1-2.amzn2023.0.13 |
| Amazon Linux 2023 | python3-urllib3 | 1.25.10-5.amzn2023.0.5 |
| Amazon Linux 2023 | python3.11-pip | 22.3.1-2.amzn2023.0.7 |
| Amazon Linux 2023 | python3.11-pip-wheel | 22.3.1-2.amzn2023.0.7 |
| Amazon Linux 2023 | python3.12-pip | 23.2.1-4.amzn2023.0.5 |
| Amazon Linux 2023 | python3.12-pip-wheel | 23.2.1-4.amzn2023.0.5 |
| Chainguard | airflow-2 | 2.11.0-r5 |
| Chainguard | airflow-2-bitnami-compat | 2.11.0-r5 |
| Chainguard | airflow-2-compat | 2.11.0-r5 |
| Chainguard | airflow-2-iamguarded-compat | 2.11.0-r5 |
| Chainguard | airflow-3 | 3.0.2-r2 |
| Chainguard | airflow-3-bitnami-compat | 3.0.2-r2 |
| Chainguard | airflow-3-compat | 3.0.2-r2 |
| Chainguard | airflow-3-iamguarded-compat | 3.0.2-r2 |
| Chainguard | airflow-core-2 | 2.11.0-r3 |
| Chainguard | airflow-core-2-compat | 2.11.0-r3 |
| Chainguard | airflow-core-2-oci-entrypoint | 2.11.0-r3 |
| Chainguard | ansible-operator | 1.42.2-r5 |
| Chainguard | ansible-operator-fips | 1.42.2-r5 |
| Chainguard | apache-beam-python-3.11-sdk | 2.65.0-r2 |
| Chainguard | awx | 24.6.1-r33 |
| Chainguard | az | 2.74.0-r3 |
| Chainguard | az-iamguarded-compat | 2.74.0-r3 |
| Chainguard | azure-functions-host-python3.11-worker | 4.1048.200-r1 |
| Chainguard | azure-functions-host-python3.12-worker | 4.1048.200-r1 |
| Chainguard | azure-functions-host-python3.13-worker | 4.1048.200-r1 |
| Chainguard | barman | 3.14.1-r0 |
| Chainguard | barman-cloudnative-pg | 3.14.1-r0 |
| Chainguard | confluent-docker-utils | 0.0.162-r1 |
| Chainguard | dask-gateway | 2025.4.0-r7 |
| Chainguard | dask-kubernetes | 2025.4.3-r4 |
| Chainguard | datadog-agent-7.71 | 7.71.2-r22 |
| Chainguard | datadog-agent-7.71-core-integrations | 7.71.2-r22 |
| Chainguard | datadog-agent-7.72 | 7.72.4-r22 |
| Chainguard | datadog-agent-7.72-core-integrations | 7.72.4-r22 |
| Chainguard | datadog-agent-7.73 | 7.73.3-r13 |
| Chainguard | datadog-agent-7.73-core-integrations | 7.73.3-r13 |
| Chainguard | datadog-agent-7.74 | 7.74.1-r15 |
| Chainguard | datadog-agent-7.74-core-integrations | 7.74.1-r15 |
| Chainguard | datadog-agent-7.75 | 7.75.4-r7 |
| Chainguard | datadog-agent-7.75-core-integrations | 7.75.4-r7 |
| Chainguard | datadog-agent-7.76 | 7.76.3-r41 |
| Chainguard | datadog-agent-7.76 | 7.76.3-r15 |
| Chainguard | datadog-agent-7.76-core-integrations | 7.76.3-r15 |
| Chainguard | datadog-agent-7.77 | 7.77.3-r6 |
| Chainguard | datadog-agent-7.77-core-integrations | 7.77.3-r6 |
| Chainguard | datadog-agent-fips-7.71 | 7.71.2-r15 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | 7.71.2-r15 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | 7.71.2-r19 |
| Chainguard | datadog-agent-fips-7.72 | 7.72.4-r15 |
| Chainguard | datadog-agent-fips-7.72 | 7.72.4-r14 |
| Chainguard | datadog-agent-fips-7.72-core-integrations | 7.72.4-r14 |
| Chainguard | datadog-agent-fips-7.72-core-integrations | 7.72.4-r15 |
| Chainguard | datadog-agent-fips-7.73 | 7.73.3-r12 |
| Chainguard | datadog-agent-fips-7.73-core-integrations | 7.73.3-r12 |
| Chainguard | datadog-agent-fips-7.74 | 7.74.1-r12 |
| Chainguard | datadog-agent-fips-7.74-core-integrations | 7.74.1-r12 |
| Chainguard | datadog-agent-fips-7.75 | 7.75.4-r5 |
| Chainguard | datadog-agent-fips-7.75-core-integrations | 7.75.4-r5 |
| Chainguard | datadog-agent-fips-7.76 | 7.76.3-r12 |
| Chainguard | datadog-agent-fips-7.76-core-integrations | 7.76.3-r12 |
| Chainguard | datadog-agent-fips-7.77 | 7.77.3-r7 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | 7.77.3-r7 |
| Chainguard | datadog-agent-fips-7.77-core-integrations | 7.77.3-r6 |
| Chainguard | emissary | 3.10.0-r6 |
| Chainguard | emissary-apiext | 3.10.0-r6 |
| Chainguard | emissary-oci-entrypoint | 3.10.0-r6 |
| Chainguard | ggshield | 1.43.0-r0 |
| Chainguard | gitlab-cng-18.2 | no fix |
| Chainguard | gitlab-toolbox-ce-18.7 | no fix |
| Chainguard | gitlab-toolbox-ce-18.8 | no fix |
| Chainguard | gitlab-toolbox-ce-fips-18.7 | no fix |
| Chainguard | gitlab-toolbox-ce-fips-18.8 | no fix |
| Chainguard | graalvm-25-graalpy-venv | 25.0.2-r10 |
| Chainguard | jupyter-base-notebook | 7.4.3-r2 |
| Chainguard | jupyter-docker-base | 999.9.9_git20260925-r0 |
| Chainguard | jupyter-docker-stacks | 999.9.9_git20260925-r0 |
| Chainguard | jwt-tool | 2.3.0-r2 |
| Chainguard | k8s-sidecar | 1.30.5-r0 |
| Chainguard | katib-earlystopping | 0.19.0-r3 |
| Chainguard | katib-earlystopping | 0.19.0-r15 |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r14 |
| Chainguard | katib-suggestion-hyperband | 0.19.0-r13 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r14 |
| Chainguard | katib-suggestion-hyperopt | 0.19.0-r13 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r13 |
| Chainguard | katib-suggestion-nas-darts | 0.19.0-r14 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r14 |
| Chainguard | katib-suggestion-optuna-enas | 0.19.0-r13 |
| Chainguard | katib-suggestion-pbt-enas | 0.19.0-r13 |
| Chainguard | katib-suggestion-skopt-enas | 0.19.0-r13 |
| Chainguard | kserve | 0.16.0-r6 |
| Chainguard | kserve-agent | 0.16.0-r6 |
| Chainguard | kserve-agent-compat | 0.16.0-r6 |
| Chainguard | kserve-manager | 0.16.0-r6 |
| Chainguard | kserve-manager-compat | 0.16.0-r6 |
| Chainguard | kserve-qpext | 0.16.0-r6 |
| Chainguard | kserve-qpext-compat | 0.16.0-r6 |
| Chainguard | kserve-router | 0.16.0-r6 |
| Chainguard | kserve-router-compat | 0.16.0-r6 |
| Chainguard | kserve-storage-controller | 0.16.0-r6 |
| Chainguard | kubeflow-jupyter-web-app | 1.10.0-r5 |
| Chainguard | kubeflow-pipelines | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-apiserver | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-cache_server | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-frontend | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.5.0-r4 |
| Chainguard | localstack | 4.14.0-r9 |
| Chainguard | mlflow | 3.1.0-r3 |
| Chainguard | mlflow-iamguarded-compat | 3.1.0-r3 |
| Chainguard | nemo | 2.6.1-r1 |
| Chainguard | nemo | 2.7.3-r2 |
| Chainguard | nvidia-nsight-compute-13.1 | 2025.4.1.2-r1 |
| Chainguard | nvidia-nsight-compute-13.1 | 2025.4.0.12-r0 |
| Chainguard | nvidia-nsight-compute-13.2 | 2026.1.1.2-r2 |
| Chainguard | nvidia-nsight-compute-13.3 | 2026.2.1.5-r1 |
| Chainguard | openstack-kolla-toolbox-2025.1 | 20.4.0-r3 |
| Chainguard | openstack-kolla-toolbox-2025.1-fips | 20.4.0-r2 |
| Chainguard | openstack-kolla-toolbox-2025.2 | 21.1.0-r2 |
| Chainguard | openstack-kolla-toolbox-2025.2-fips | 21.1.0-r2 |
| Chainguard | pgadmin4 | 9.12-r1 |
| Chainguard | pgadmin4-fips | 9.12-r1 |
| Chainguard | py3-cassandra-medusa | 0.27.0-r1 |
| Chainguard | py3-cassandra-medusa | 0.28.0-r1 |
| Chainguard | py3-hashin | 1.0.5-r5 |
| Chainguard | py3.10-ambassador | 3.10.0-r6 |
| Chainguard | py3.10-pip-base | 26.1.1-r0 |
| Chainguard | py3.10-pipenv | 2026.6.0-r0 |
| Chainguard | py3.11-ambassador | 3.10.0-r6 |
| Chainguard | py3.11-pip-base | 26.1.1-r0 |
| Chainguard | py3.11-pipenv | 2026.6.0-r0 |
| Chainguard | py3.12-ambassador | 3.10.0-r6 |
| Chainguard | py3.12-pip-base | 26.1.1-r0 |
| Chainguard | py3.12-pipenv | 2026.6.0-r0 |
| Chainguard | py3.13-ambassador | 3.10.0-r6 |
| Chainguard | py3.13-pip-base | 26.1.1-r0 |
| Chainguard | py3.13-pipenv | 2026.6.0-r0 |
| Chainguard | py3.13-scanner-test-libraries | 0.0.1-r2 |
| Chainguard | py3.13-scanner-test-scanner-test-python-vulnerability-fixed | no fix |
| Chainguard | py3.13-scanner-test-scanner-test-python-vulnerability-unfixed | no fix |
| Chainguard | py3.14-pip-base | 26.1.1-r0 |
| Chainguard | py3.9-pip | no fix |
| Chainguard | pypy-3.10 | 7.3.19-r16 |
| Chainguard | pypy-3.11 | 7.3.22-r0 |
| Chainguard | request-1276 | 0.28.0-r1 |
| Chainguard | spamcheck | 3.5.3-r3 |
| Chainguard | spamcheck-compat | 3.5.3-r3 |
| Chainguard | superset | 4.1.2-r6 |
| Chainguard | tensorflow-cpu-jupyter | 2.21.0-r4 |
| Chainguard | tensorflow-gpu-jupyter | 2.21.0-r4 |
| Chainguard | text-generation-inference | 3.3.6-r3 |
| Debian 11 | python-urllib3 | 1.26.5-1~exp1+deb11u2 |
| Debian 12 | python-urllib3 | 1.26.12-1+deb12u2 |
| Debian 13 | python-urllib3 | 2.3.0-3 |
| Debian 14 | python-urllib3 | 2.3.0-3 |
| SUSE Linux Enterprise Micro 5.1 | python-urllib3 | 1.25.10-150300.4.18.1 |
| SUSE Linux Enterprise Micro 5.2 | python-urllib3 | 1.25.10-150300.4.18.1 |
| SUSE Linux Enterprise Micro 5.3 | python-urllib3 | 1.25.10-150300.4.18.1 |
| SUSE Linux Enterprise Micro 5.4 | python-urllib3 | 1.25.10-150300.4.18.1 |
| SUSE Linux Enterprise Micro 5.5 | python-urllib3 | 1.25.10-150300.4.18.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP6 | python-urllib3 | 1.25.10-150300.4.18.1 |
| SUSE Linux Enterprise Module for Basesystem 15 SP7 | python-urllib3 | 1.25.10-150300.4.18.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-urllib3 | 1.25.10-3.43.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-urllib3 | 2.0.7-150400.7.21.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | python-urllib3 | 2.0.7-150400.7.21.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP7 | python-urllib3 | 2.0.7-150400.7.21.1 |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | python-urllib3 | 1.25.10-3.43.1 |
| SUSE Linux Micro 6.0 | python-urllib3 | 2.1.0-3.1 |
| SUSE Linux Micro 6.1 | python-urllib3 | 2.1.0-slfo.1.1_2.1 |
| Ubuntu 22.04 LTS | python-pip | 22.0.2+dfsg-1ubuntu0.6 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.3 |
| Ubuntu 24.04 LTS | python-pip | 24.0+dfsg-1ubuntu1.2 |
| Ubuntu 24.04 LTS | python-urllib3 | 2.0.7-1ubuntu0.2 |
| Ubuntu Pro 16.04 LTS | python-urllib3 | 1.13.1-2ubuntu0.16.04.4+esm3 |
| Ubuntu Pro 18.04 LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm3 |
| Ubuntu Pro 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm1 |
| Wolfi | airflow-3 | 3.0.2-r2 |
| Wolfi | airflow-3-bitnami-compat | 3.0.2-r2 |
| Wolfi | airflow-3-compat | 3.0.2-r2 |
| Wolfi | airflow-3-iamguarded-compat | 3.0.2-r2 |
| Wolfi | az | 2.74.0-r3 |
| Wolfi | az-iamguarded-compat | 2.74.0-r3 |
| Wolfi | confluent-docker-utils | 0.0.162-r1 |
| Wolfi | dask-gateway | 2025.4.0-r7 |
| Wolfi | dask-kubernetes | 2025.4.3-r4 |
| Wolfi | datadog-agent-7.72 | 7.72.4-r22 |
| Wolfi | datadog-agent-7.72-core-integrations | 7.72.4-r22 |
| Wolfi | datadog-agent-7.73 | 7.73.3-r13 |
| Wolfi | datadog-agent-7.73-core-integrations | 7.73.3-r13 |
| Wolfi | datadog-agent-7.74 | 7.74.1-r15 |
| Wolfi | datadog-agent-7.74-core-integrations | 7.74.1-r15 |
| Wolfi | datadog-agent-7.75 | 7.75.4-r7 |
| Wolfi | datadog-agent-7.75-core-integrations | 7.75.4-r7 |
| Wolfi | datadog-agent-7.76 | 7.76.3-r15 |
| Wolfi | datadog-agent-7.76 | 7.76.3-r41 |
| Wolfi | datadog-agent-7.76-core-integrations | 7.76.3-r15 |
| Wolfi | datadog-agent-7.77 | 7.77.3-r6 |
| Wolfi | datadog-agent-7.77-core-integrations | 7.77.3-r6 |
| Wolfi | emissary | 3.10.0-r6 |
| Wolfi | emissary-apiext | 3.10.0-r6 |
| Wolfi | emissary-oci-entrypoint | 3.10.0-r6 |
| Wolfi | ggshield | 1.43.0-r0 |
| Wolfi | gitlab-cng-18.2 | no fix |
| Wolfi | jupyter-base-notebook | 7.4.3-r2 |
| Wolfi | jupyter-docker-base | 999.9.9_git20260925-r0 |
| Wolfi | jupyter-docker-stacks | 999.9.9_git20260925-r0 |
| Wolfi | jwt-tool | 2.3.0-r2 |
| Wolfi | k8s-sidecar | 1.30.5-r0 |
| Wolfi | katib-earlystopping | 0.19.0-r3 |
| Wolfi | katib-earlystopping | 0.19.0-r15 |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r13 |
| Wolfi | katib-suggestion-hyperband | 0.19.0-r14 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r14 |
| Wolfi | katib-suggestion-hyperopt | 0.19.0-r13 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r13 |
| Wolfi | katib-suggestion-nas-darts | 0.19.0-r14 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r14 |
| Wolfi | katib-suggestion-optuna-enas | 0.19.0-r13 |
| Wolfi | katib-suggestion-pbt-enas | 0.19.0-r13 |
| Wolfi | katib-suggestion-skopt-enas | 0.19.0-r13 |
| Wolfi | kserve | 0.16.0-r6 |
| Wolfi | kserve-agent | 0.16.0-r6 |
| Wolfi | kserve-agent-compat | 0.16.0-r6 |
| Wolfi | kserve-manager | 0.16.0-r6 |
| Wolfi | kserve-manager-compat | 0.16.0-r6 |
| Wolfi | kserve-qpext | 0.16.0-r6 |
| Wolfi | kserve-qpext-compat | 0.16.0-r6 |
| Wolfi | kserve-router | 0.16.0-r6 |
| Wolfi | kserve-router-compat | 0.16.0-r6 |
| Wolfi | kserve-storage-controller | 0.16.0-r6 |
| Wolfi | kubeflow-jupyter-web-app | 1.10.0-r5 |
| Wolfi | kubeflow-pipelines | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-apiserver | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-cache_server | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-frontend | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.5.0-r4 |
| Wolfi | mlflow | 3.1.0-r3 |
| Wolfi | mlflow-iamguarded-compat | 3.1.0-r3 |
| Wolfi | py3-cassandra-medusa | 0.28.0-r1 |
| Wolfi | py3-cassandra-medusa | 0.27.0-r1 |
| Wolfi | py3.10-ambassador | 3.10.0-r6 |
| Wolfi | py3.10-pip-base | 26.1.1-r0 |
| Wolfi | py3.10-pipenv | 2026.6.0-r0 |
| Wolfi | py3.11-ambassador | 3.10.0-r6 |
| Wolfi | py3.11-pip-base | 26.1.1-r0 |
| Wolfi | py3.11-pipenv | 2026.6.0-r0 |
| Wolfi | py3.12-ambassador | 3.10.0-r6 |
| Wolfi | py3.12-pip-base | 26.1.1-r0 |
| Wolfi | py3.12-pipenv | 2026.6.0-r0 |
| Wolfi | py3.13-ambassador | 3.10.0-r6 |
| Wolfi | py3.13-pip-base | 26.1.1-r0 |
| Wolfi | py3.13-pipenv | 2026.6.0-r0 |
| Wolfi | py3.14-pip-base | 26.1.1-r0 |
| Wolfi | pypy-3.10 | 7.3.19-r16 |
| Wolfi | pypy-3.11 | 7.3.22-r0 |
| Wolfi | superset | 4.1.2-r6 |
| openSUSE Leap 15.6 | python-urllib3 | 2.0.7-150400.7.21.1 |
| openSUSE Tumbleweed | oci-cli | 3.76.2-1.1 |
| openSUSE Tumbleweed | python-urllib3 | 2.5.0-1.1 |
| openSUSE Tumbleweed | python-urllib3_1 | 1.26.20-3.1 |