PyPI/urllib3 CVE-2025-50181: medium 5.3, EPSS 0.47%

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Action: Upgrade urllib3 to 2.5.0 or later.

pip install urllib3==2.5.0

Affected

Fixed versions

Sources

• osv: PYSEC-2026-1999
• https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v
• https://nvd.nist.gov/vuln/detail/CVE-2025-50181
• https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857
• https://github.com/urllib3/urllib3
• https://github.com/urllib3/urllib3/releases/tag/2.5.0
• https://pypi.org/project/urllib3
• https://github.com/advisories/GHSA-pq67-6m6q-mj2v

CVE-2025-50181 · published 2026-07-07T16:02:55.519678Z · modified 2026-07-07T17:47:54.161376347Z · JSON