PT-2025-26199 · Pypi+4 · Urllib3+4

Illia-V · Published 2025-06-18 · Updated 2026-05-19 · CVE-2025-50182

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 2.5.0

Description The issue concerns urllib3, a Python HTTP client library, which does not control redirects in browsers and Node.js prior to version 2.5.0. This library supports being used in a Pyodide runtime, utilizing the JavaScript Fetch API or falling back on XMLHttpRequest, allowing Python libraries to make HTTP requests from a browser or Node.js. However, the retries and redirect parameters are ignored with Pyodide, as the runtime itself determines redirect behavior. Redirects can be used to exploit SSRF vulnerabilities, and applications attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects may remain vulnerable if a Pyodide runtime redirect mechanism is unsuitable.

Recommendations For versions prior to 2.5.0, upgrade to a patched version of urllib3. As a temporary workaround, consider restricting the use of urllib3 in Pyodide runtime to minimize the risk of exploitation. Avoid relying on urllib3 to control the number of redirects for an HTTP request in a Pyodide runtime until the issue is resolved.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2025-09780

CVE-2025-50182

ECHO-3380-B531-9695

GHSA-48P4-8XCF-VXJ5

OPENSUSE-SU-2025:15283-1

USN-7599-1

Affected Products

Astra Linux

Debian

Linuxmint

Ubuntu

Urllib3

References · 33

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/50xxx/CVE-2025-50182.json · Exploit
• https://github.com/urllib3/urllib3/security/advisories/GHSA-48p4-8xcf-vxj5 · Vendor Advisory
• https://github.com/urllib3/urllib3/commit/7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f · Patch
• https://ubuntu.com/security/CVE-2025-50181 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-50182 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-7599-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15283-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-48p4-8xcf-vxj5 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-50182 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-50182 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-50182 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09780 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2025-50182 · Vendor Advisory
• https://osv.dev/vulnerability/USN-7599-1 · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2025-50182 · Vendor Advisory