CVE-2025-50182mediumCWE-601

CVE-2025-50182: falha de média gravidade em urllib3

urllib3 does not control redirects in browsers and Node.js

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar urllib3+ Monitorar python-urllib3

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.6%
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Produtos afetados
urllib3 · urllib3
CVEs relacionadas — urllib3

No mesmo produto, das mais perigosas para as menos.

CVE-2026-21441HIGHurllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)EPSS 2.9%CVE-2023-43804MEDIUM`Cookie` HTTP header isn't stripped on cross-origin redirectsEPSS 1.4%CVE-2024-37891MEDIUMProxy-Authorization request header isn't stripped during cross-origin redirects in urllib3EPSS 1.1%CVE-2025-66471HIGHurllib3 Streaming API improperly handles highly compressed dataEPSS 0.7%CVE-2025-66418HIGHurllib3 allows an unbounded number of links in the decompression chainEPSS 0.7%CVE-2026-44432HIGHurllib3: Decompression-bomb safeguards bypassed in parts of the streaming APIEPSS 0.7%