-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PythonPythonMiggo AIRoot Cause AnalysisThe vulnerability CVE-2025-50181 in urllib3 (versions < 2.5.0) arises from the PoolManager failing to disable redirects when configured to do so via its retries parameter during instantiation. For example, PoolManager(retries=0) or PoolManager(retries=False) was intended to prevent any redirects, but this setting was ignored.
The root cause lies in two key methods of urllib3.poolmanager.PoolManager:
urllib3.poolmanager.PoolManager.__init__: The constructor was flawed because it did not properly process the retries argument (when passed as an integer like 0, or as False, or as a Retry object with redirect=0) to ensure that the internal Retry object for the PoolManager instance was configured to disallow redirects. The patch (commit f05b1329126d5be6de501f9d1e3e36738bc08857) introduces specific logic in __init__ to correctly create or modify the Retry object to set its raise_on_redirect attribute appropriately, thereby enforcing the no-redirect policy.
urllib3.poolmanager.PoolManager.urlopen: This method is responsible for making the actual HTTP request and applying the retry/redirect logic. It uses the Retry object associated with the PoolManager (if not overridden by a request-specific Retry object). In vulnerable versions, urlopen would use the Retry object that __init__ had failed to correctly configure for disabling redirects. Consequently, urlopen would follow redirects even when the PoolManager was initialized with the intent to disable them.
If an application relied on disabling redirects at the PoolManager level to mitigate risks like Server-Side Request Forgery (SSRF) or open redirects, this vulnerability would leave it exposed because the redirects would still be followed. The fix ensures that the retries parameter in PoolManager.__init__ correctly translates to a redirect policy that urlopen then enforces.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| urllib3 | pip | < 2.5.0 | 2.5.0 |
Ongoing coverage of React2Shell