urllib3 does not control redirects in browsers and Node.js
Priority LOW 28CWE-601Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- Low
- Impact type
- Spoofing
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 4 fixed, 32 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-601.
Summary
urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00602 49th percentileScored 2026-11-07
Fix Partial urllib3 (urllib3): 2.5.0urllib3 (PyPI): 2.5.0Red Hat: 4 advisoriesRed Hat: 4 fixed, 32 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| python-pillow | urllib3 | 2.2.0 to before 2.5.0 | 2.5.0 | Patch available | CNA |
| — | urllib3 (PyPI) | 2.2.0 to before 2.5.0 | 2.5.0 | Patch available | GHSA-48p4-8xcf-vxj5 |
- urllib3 Vendorpython-pillow Affected 2.2.0 to before 2.5.0 Fixed in 2.5.0 Patch available CNA
- urllib3 (PyPI) Vendor— Affected 2.2.0 to before 2.5.0 Fixed in 2.5.0 Patch available GHSA-48p4-8xcf-vxj5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* | 2.2.0 to before 2.5.0 | Vulnerable | python-pillow |
- cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:* Versions 2.2.0 to before 2.5.0 Vulnerable ·python-pillow
Remediation
- Fix · CNA urllib3 (urllib3) Fixed in 2.5.0
- Fix · GHSA-48p4-8xcf-vxj5 urllib3 (PyPI) Fixed in 2.5.0 Advisory →
Red Hat 4 advisories
- RHSA-2026:86618 Released 2026-10-21 · Red Hat rating CriticalNew container image: rhceph-9.2
- Red Hat Ceph Storage 9.2 registry.redhat.io/rhceph/rhceph-9-rhel10
- RHSA-2026:83548 Released 2026-10-15 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 7.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-7-rhel9
- RHSA-2026:62115 Released 2026-09-01 · Red Hat rating ImportantRed Hat Ceph Storage
- Red Hat Ceph Storage 8.1 registry.redhat.io/rhceph/grafana-rhel9, registry.redhat.io/rhceph/rhceph-8-rhel9
Show 1 more Red Hat advisories
- RHSA-2026:3406 Released 2026-02-26 · Red Hat rating ImportantNew container image: rhceph-9.0
- Red Hat Ceph Storage 9 registry.redhat.io/rhceph/grafana-rhel10, registry.redhat.io/rhceph/rhceph-9-rhel9
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Assisted Installer for Red Hat OpenShift Container Platform 2 | Affected | No fix planned: Out of support scope |
| Builds for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Confidential Compute Attestation | Affected | No fix yet: Fix deferred |
| Custom Metric Autoscaler operator for Red Hat Openshift | Affected | No fix yet: Fix deferred |
| Migration Toolkit for Virtualization | Affected | No fix planned: Will not fix |
| Multiarch Tuning Operator | Affected | No fix yet: Fix deferred |
| Network Observability Operator | Affected | No fix planned: Will not fix |
| OpenShift Lightspeed | Affected | No fix yet: Fix deferred |
| OpenShift Pipelines | Affected | No fix yet: Fix deferred |
| OpenShift Serverless | Affected | No fix yet: Fix deferred |
| OpenShift Service Mesh 3 | Affected | No fix yet: Fix deferred |
| Red Hat AI Inference Server | Affected | No fix yet: Fix deferred |
| Red Hat Ansible Automation Platform 2 | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 6 | Affected | No fix yet |
| Red Hat Ceph Storage 7 | Affected | No fix yet |
| Red Hat Ceph Storage 8 | Affected | No fix yet |
| Red Hat Ceph Storage 9 | Affected | No fix yet |
| Red Hat Developer Hub 1 | Affected | No fix yet: Fix deferred |
| Red Hat Discovery 1 | Affected | No fix yet: Fix deferred |
| Red Hat Edge Manager preview | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 10 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 7 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 9 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux AI (RHEL AI) | Affected | No fix yet: Fix deferred |
| Red Hat Offline Knowledge Portal | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift AI (RHOAI) | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
| Red Hat Quay 3 | Affected | No fix yet: Fix deferred |
| Red Hat Satellite 6 | Affected | No fix yet: Fix deferred |
| Red Hat Trusted Artifact Signer | Affected | No fix planned: Will not fix |
| cert-manager Operator for Red Hat OpenShift | Affected | No fix yet: Fix deferred |
| Red Hat Ceph Storage 7.1 | Fixed | RHSA-2026:83548 |
| Red Hat Ceph Storage 8.1 | Fixed | RHSA-2026:62115 |
| Red Hat Ceph Storage 9 | Fixed | RHSA-2026:3406 |
| Red Hat Ceph Storage 9.2 | Fixed | RHSA-2026:86618 |
Not affected: 8 products
- Red Hat Ceph Storage 7.1
- Red Hat Ceph Storage 8.1
- Red Hat Ceph Storage 9
- Red Hat Ceph Storage 9.2
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat build of Quarkus Native builder
Timeline
- 2026-10-02 Threatist record created from CVE-2025-50182
- 2026-10-03 Alias added: GHSA-48p4-8xcf-vxj5
- 2026-10-09 Affected versions changed · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83548 · Red Hat
- 2026-10-16 Fix available: Red Hat Ceph Storage 7.1 · Red Hat
- 2026-10-21 Fix available: RHSA-2026:86618 · Red Hat
- 2026-10-21 Fix available: Red Hat Ceph Storage 9.2 · Red Hat
- 2026-10-27 Affected versions changed · Red Hat
References
Advisory 2
More python-pillow Urllib3 vulnerabilities
- TI-2026-17326 urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API) CVSS 4.0HIGH 8.9
- TI-2018-14221 urllib3 before version 1.23 does not remove the Authorization HTTP header when following… CVSS 3.0CRITICAL 9.8
- TI-2025-40854 urllib3 allows an unbounded number of links in the decompression chain CVSS 4.0HIGH 8.9
- TI-2026-32373 urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API CVSS 4.0HIGH 8.9
- TI-2025-40898 urllib3 Streaming API improperly handles highly compressed data CVSS 4.0HIGH 8.9
- TI-2021-12905 An issue was discovered in urllib3 before 1.26.5. CVSS 3.1HIGH 7.5
Sources
- CVE-2025-50182 · CVE Program
- CVE-2025-50182 · NVD
- FIRST EPSS
- GHSA-48p4-8xcf-vxj5 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-50182 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences