urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Priority LOW 28CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 5 fixed, 31 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00474 41st percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial urllib3 (urllib3): 2.5.0urllib3 (PyPI): 2.5.0Red Hat: 6 advisoriesRed Hat: 5 fixed, 31 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| python-pillow | urllib3 | before 2.5.0 | 2.5.0 | Patch available | CNA |
| — | urllib3 (PyPI) | before 2.5.0 | 2.5.0 | Patch available | GHSA-pq67-6m6q-mj2v |
- urllib3 Vendorpython-pillow Affected before 2.5.0 Fixed in 2.5.0 Patch available CNA
- urllib3 (PyPI) Vendor— Affected before 2.5.0 Fixed in 2.5.0 Patch available GHSA-pq67-6m6q-mj2v
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* | before 2.5.0 | Vulnerable | python-pillow |
- cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions before 2.5.0 Vulnerable ·python-pillow
Remediation
- Fix · CNA urllib3 (urllib3) Fixed in 2.5.0
- Fix · GHSA-pq67-6m6q-mj2v urllib3 (PyPI) Fixed in 2.5.0 Advisory →
Red Hat 6 advisories
- RHSA-2026:86618 Released 2026-10-21 · Red Hat rating CriticalNew container image: rhceph-9.2
- Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
- RHSA-2026:83548 Released 2026-10-15 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:62115 Released 2026-09-01 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
Show 3 more Red Hat advisories
- RHSA-2026:33154 Released 2026-06-29 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:4215 Released 2026-03-10 · Red Hat rating ImportantRed Hat Quay 3.14.6
- Red Hat Quay 3.14 registry.redhat.io/quay/quay-rhel8
- RHSA-2026:3406 Released 2026-02-26 · Red Hat rating ImportantNew container image: rhceph-9.0
- Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix planned: Out of support scope |
| Builds for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager preview | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
| Red Hat Offline Knowledge Portal | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix planned: Will not fix |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7.1 | Fixed | RHSA-2026:33154, RHSA-2026:83548 |
| Red Hat Ceph Storage 8.1 | Fixed | RHSA-2026:62115 |
| Red Hat Ceph Storage 9 | Fixed | RHSA-2026:3406 |
| Red Hat Ceph Storage 9.2 | Fixed | RHSA-2026:86618 |
| Red Hat Quay 3.14 | Fixed | RHSA-2026:4215 |
Not affected: 9 products
- Red Hat Ceph Storage 7.1
- Red Hat Ceph Storage 8.1
- Red Hat Ceph Storage 9
- Red Hat Ceph Storage 9.2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Quay 3.14
- Red Hat build of Quarkus Native builder
Timeline
- 2026-10-02 Threatist record created from CVE-2025-50181
- 2026-10-03 Alias added: GHSA-pq67-6m6q-mj2v
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
- 2026-10-16 Affected versions changed · Red Hat
- 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
- 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
More python-pillow Urllib3 vulnerabilities
- TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
- TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
- TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
- TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
- TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
- TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
Sources
- CVE-2025-50181 · CVE Program
- CVE-2025-50181 · NVD
- FIRST EPSS
- GHSA-pq67-6m6q-mj2v · GitHub Advisory Database · CC BY 4.0
- CVE-2025-50181 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences