CVE-2025-50182
Fixed in a distro release EPSS <1%CVSS 5.3
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Products: urllib3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | urllib3 | 2.5.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | airflow-2 | 2.11.0-r5 |
| Chainguard | airflow-2-bitnami-compat | 2.11.0-r5 |
| Chainguard | airflow-2-compat | 2.11.0-r5 |
| Chainguard | airflow-2-iamguarded-compat | 2.11.0-r5 |
| Chainguard | airflow-3 | 3.0.2-r2 |
| Chainguard | airflow-3-bitnami-compat | 3.0.2-r2 |
| Chainguard | airflow-3-compat | 3.0.2-r2 |
| Chainguard | airflow-3-iamguarded-compat | 3.0.2-r2 |
| Chainguard | airflow-core-2 | 2.11.0-r3 |
| Chainguard | airflow-core-2-compat | 2.11.0-r3 |
| Chainguard | airflow-core-2-oci-entrypoint | 2.11.0-r3 |
| Chainguard | ansible-operator | 0 |
| Chainguard | ansible-operator-compat | 0 |
| Chainguard | apache-beam-python-3.11-sdk | 2.65.0-r2 |
| Chainguard | az | 2.74.0-r3 |
| Chainguard | az-iamguarded-compat | 2.74.0-r3 |
| Chainguard | barman | 3.14.1-r0 |
| Chainguard | barman-cloudnative-pg | 3.14.1-r0 |
| Chainguard | confluent-docker-utils | 0.0.162-r1 |
| Chainguard | dask-gateway | 2025.4.0-r1 |
| Chainguard | dask-gateway-server | 2025.4.0-r1 |
| Chainguard | dask-kubernetes | 2025.4.3-r4 |
| Chainguard | datadog-agent-fips-7.71-core-integrations | 7.71.2-r19 |
| Chainguard | emissary | 3.10.0-r6 |
| Chainguard | emissary-apiext | 3.10.0-r6 |
| Chainguard | emissary-oci-entrypoint | 3.10.0-r6 |
| Chainguard | ggshield | 1.43.0-r0 |
| Chainguard | jupyter-base-notebook | 7.4.3-r2 |
| Chainguard | jupyter-docker-base | 999.9.9_git20260925-r0 |
| Chainguard | jupyter-docker-stacks | 999.9.9_git20260925-r0 |
| Chainguard | jwt-tool | 2.3.0-r2 |
| Chainguard | k8s-sidecar | 1.30.5-r0 |
| Chainguard | katib-earlystopping | 0.19.0-r0 |
| Chainguard | katib-earlystopping | 0.19.0-r3 |
| Chainguard | kserve | 0.16.0-r6 |
| Chainguard | kserve-agent | 0.16.0-r6 |
| Chainguard | kserve-agent-compat | 0.16.0-r6 |
| Chainguard | kserve-manager | 0.16.0-r6 |
| Chainguard | kserve-manager-compat | 0.16.0-r6 |
| Chainguard | kserve-qpext | 0.16.0-r6 |
| Chainguard | kserve-qpext-compat | 0.16.0-r6 |
| Chainguard | kserve-router | 0.16.0-r6 |
| Chainguard | kserve-router-compat | 0.16.0-r6 |
| Chainguard | kserve-storage-controller | 0.16.0-r6 |
| Chainguard | kubeflow-jupyter-web-app | 1.10.0-r5 |
| Chainguard | kubeflow-pipelines | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-apiserver | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-cache-deployer | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-cache-deployer-compat | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-cache_server | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-frontend | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-envoy-config | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-writer | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-metadata-writer-compat | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-persistence_agent | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-scheduledworkflow | 2.5.0-r4 |
| Chainguard | kubeflow-pipelines-viewer-crd-controller | 2.5.0-r4 |
| Chainguard | mlflow | 3.1.0-r3 |
| Chainguard | mlflow-iamguarded-compat | 3.1.0-r3 |
| Chainguard | nemo | 2.3.1-r4 |
| Chainguard | pgadmin4 | 9.4-r2 |
| Chainguard | pgadmin4-oci-entrypoint | 9.4-r2 |
| Chainguard | py3-cassandra-medusa | 0.26.0-r0 |
| Chainguard | py3-hashin | 1.0.5-r1 |
| Chainguard | py3-pipenv | 2025.0.3-r0 |
| Chainguard | py3-supported-pipenv | 2025.0.3-r0 |
| Chainguard | py3.10-ambassador | 3.10.0-r6 |
| Chainguard | py3.10-pip-base | 25.3-r1 |
| Chainguard | py3.10-pipenv | 2025.0.3-r0 |
| Chainguard | py3.10-pipenv-bin | 2025.0.3-r0 |
| Chainguard | py3.11-ambassador | 3.10.0-r6 |
| Chainguard | py3.11-pipenv | 2025.0.3-r0 |
| Chainguard | py3.11-pipenv-bin | 2025.0.3-r0 |
| Chainguard | py3.12-ambassador | 3.10.0-r6 |
| Chainguard | py3.12-pipenv | 2025.0.3-r0 |
| Chainguard | py3.12-pipenv-bin | 2025.0.3-r0 |
| Chainguard | py3.13-ambassador | 3.10.0-r6 |
| Chainguard | py3.13-pipenv | 2025.0.3-r0 |
| Chainguard | py3.13-pipenv-bin | 2025.0.3-r0 |
| Chainguard | py3.9-pip | 25.1.1-r0 |
| Chainguard | pypy-3.10 | 7.3.19-r10 |
| Chainguard | pypy-3.10-compat | 7.3.19-r10 |
| Chainguard | pypy-3.11 | 7.3.19-r37 |
| Chainguard | pypy-3.11-compat | 7.3.19-r37 |
| Chainguard | reflex | 0.8.0-r0 |
| Chainguard | spamcheck | 3.5.3-r3 |
| Chainguard | spamcheck-compat | 3.5.3-r3 |
| Chainguard | superset | 4.1.2-r6 |
| Chainguard | tensorflow-cpu-jupyter | 2.20.0-r4 |
| Chainguard | tensorflow-gpu-jupyter | 2.20.0-r3 |
| Chainguard | text-generation-inference | 3.3.6-r3 |
| Debian 13 | python-urllib3 | 2.3.0-3 |
| Debian 14 | python-urllib3 | 2.3.0-3 |
| Ubuntu 22.04 LTS | python-urllib3 | 1.26.5-1~exp1ubuntu0.3 |
| Ubuntu 24.04 LTS | python-urllib3 | 2.0.7-1ubuntu0.2 |
| Ubuntu Pro 16.04 LTS | python-urllib3 | 1.13.1-2ubuntu0.16.04.4+esm3 |
| Ubuntu Pro 18.04 LTS | python-urllib3 | 1.22-1ubuntu0.18.04.2+esm3 |
| Ubuntu Pro 20.04 LTS | python-urllib3 | 1.25.8-2ubuntu0.4+esm1 |
| Wolfi | airflow-3 | 3.0.2-r2 |
| Wolfi | airflow-3-bitnami-compat | 3.0.2-r2 |
| Wolfi | airflow-3-compat | 3.0.2-r2 |
| Wolfi | airflow-3-iamguarded-compat | 3.0.2-r2 |
| Wolfi | az | 2.74.0-r3 |
| Wolfi | az-iamguarded-compat | 2.74.0-r3 |
| Wolfi | confluent-docker-utils | 0.0.162-r1 |
| Wolfi | dask-gateway | 2025.4.0-r1 |
| Wolfi | dask-gateway-server | 2025.4.0-r1 |
| Wolfi | dask-kubernetes | 2025.4.3-r4 |
| Wolfi | emissary | 3.10.0-r6 |
| Wolfi | emissary-apiext | 3.10.0-r6 |
| Wolfi | emissary-oci-entrypoint | 3.10.0-r6 |
| Wolfi | ggshield | 1.43.0-r0 |
| Wolfi | jupyter-base-notebook | 7.4.3-r2 |
| Wolfi | jupyter-docker-base | 999.9.9_git20260925-r0 |
| Wolfi | jupyter-docker-stacks | 999.9.9_git20260925-r0 |
| Wolfi | jwt-tool | 2.3.0-r2 |
| Wolfi | k8s-sidecar | 1.30.5-r0 |
| Wolfi | katib-earlystopping | 0.19.0-r0 |
| Wolfi | katib-earlystopping | 0.19.0-r3 |
| Wolfi | kserve | 0.16.0-r6 |
| Wolfi | kserve-agent | 0.16.0-r6 |
| Wolfi | kserve-agent-compat | 0.16.0-r6 |
| Wolfi | kserve-manager | 0.16.0-r6 |
| Wolfi | kserve-manager-compat | 0.16.0-r6 |
| Wolfi | kserve-qpext | 0.16.0-r6 |
| Wolfi | kserve-qpext-compat | 0.16.0-r6 |
| Wolfi | kserve-router | 0.16.0-r6 |
| Wolfi | kserve-router-compat | 0.16.0-r6 |
| Wolfi | kserve-storage-controller | 0.16.0-r6 |
| Wolfi | kubeflow-jupyter-web-app | 1.10.0-r5 |
| Wolfi | kubeflow-pipelines | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-apiserver | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-cache-deployer | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-cache-deployer-compat | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-cache_server | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-frontend | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-envoy-config | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-writer | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-metadata-writer-compat | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-persistence_agent | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-scheduledworkflow | 2.5.0-r4 |
| Wolfi | kubeflow-pipelines-viewer-crd-controller | 2.5.0-r4 |
| Wolfi | mlflow | 3.1.0-r3 |
| Wolfi | mlflow-iamguarded-compat | 3.1.0-r3 |
| Wolfi | py3-cassandra-medusa | 0.26.0-r0 |
| Wolfi | py3-pipenv | 2025.0.3-r0 |
| Wolfi | py3-supported-pipenv | 2025.0.3-r0 |
| Wolfi | py3.10-ambassador | 3.10.0-r6 |
| Wolfi | py3.10-pip-base | 25.3-r1 |
| Wolfi | py3.10-pipenv | 2025.0.3-r0 |
| Wolfi | py3.10-pipenv-bin | 2025.0.3-r0 |
| Wolfi | py3.11-ambassador | 3.10.0-r6 |
| Wolfi | py3.11-pipenv | 2025.0.3-r0 |
| Wolfi | py3.11-pipenv-bin | 2025.0.3-r0 |
| Wolfi | py3.12-ambassador | 3.10.0-r6 |
| Wolfi | py3.12-pipenv | 2025.0.3-r0 |
| Wolfi | py3.12-pipenv-bin | 2025.0.3-r0 |
| Wolfi | py3.13-ambassador | 3.10.0-r6 |
| Wolfi | py3.13-pipenv | 2025.0.3-r0 |
| Wolfi | py3.13-pipenv-bin | 2025.0.3-r0 |
| Wolfi | pypy-3.10 | 7.3.19-r10 |
| Wolfi | pypy-3.10-compat | 7.3.19-r10 |
| Wolfi | pypy-3.11 | 7.3.19-r37 |
| Wolfi | pypy-3.11-compat | 7.3.19-r37 |
| Wolfi | reflex | 0.8.0-r0 |
| Wolfi | superset | 4.1.2-r6 |
| openSUSE Tumbleweed | python-urllib3 | 2.5.0-1.1 |