What is CVE-2025-50181?

CVE-2025-50181 is a medium-severity vulnerability in Python Urllib3, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 5.3/10. Published 2025-06-19.

How severe is CVE-2025-50181?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Is CVE-2025-50181 known to be exploited?

3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Open Redirect in Python Urllib3

CVE-2025-50181

urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.

Vulnerability class: Open Redirect

EPSS: 0.004 (34.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N.

Affected products

Python Urllib3
Urllib3 — versions < 2.5.0

Weakness classification (CWE)

CWE-601 — URL Redirection to Untrusted Site (Open Redirect)

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (x_refsource_MISC)

Frequently asked questions

What is CVE-2025-50181?: CVE-2025-50181 is a medium-severity vulnerability in Python Urllib3, classified under URL Redirection to Untrusted Site (Open Redirect). CVSS score: 5.3/10. Published 2025-06-19.
How severe is CVE-2025-50181?: Medium severity. CVSS v3 base score is 5.3 out of 10.
Is CVE-2025-50181 known to be exploited?: 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.