Critical Redirect Handling Vulnerability in urllib3 Package
Summary
UBUNTU-CVE-2025-50182: urllib3 is a user-friendly HTTP client library for Python. Affects python-urllib3 versions < 2.3.0-2ubuntu0.1. Fixed in 2.3.0-2ubuntu0.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a widely used HTTP client library for Python, designed to simplify the process of making HTTP requests. It is known for its user-friendly interface and robust features, including connection pooling, client-side SSL/TLS verification, and support for various HTTP methods. However, a significant vulnerability has been identified in versions 2.2.0 to 2.4.9, where the library fails to properly control redirects when used in browser environments or Node.js, potentially leading to unintended behavior.
Vulnerability Detail
The vulnerability arises from urllib3's inability to manage redirects effectively when utilized in a Pyodide runtime, which employs the JavaScript Fetch API or XMLHttpRequest. This oversight means that while urllib3 provides mechanisms to control redirects, these parameters are ignored, allowing the runtime to dictate redirect behavior. This can lead to security risks, such as redirecting users to malicious sites without their consent. The issue has been patched in version 2.5.0, addressing the redirect handling flaw.
How To Fix
Minimum fixed version
2.3.0-2ubuntu0.1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds mentioned for this vulnerability. The best course of action is to update to the patched version as soon as possible.
Conclusion
The vulnerability in urllib3 poses a significant risk due to improper redirect handling in certain environments. Users are strongly advised to update to version 2.5.0 to ensure their applications remain secure. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application integrity.
See every vulnerability recorded for python-urllib3 →
FAQ
The CVSS score for this vulnerability is 5.3, indicating a medium severity level.
Versions 2.2.0 to 2.4.9 of urllib3 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without any signup.
The primary risk is that users may be redirected to malicious websites without their knowledge, compromising their security.
Currently, there are no known workarounds. The recommended action is to update to the latest version.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-urllib3.
