{"id":"CVE-2025-50181","title":"urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation (CVE-2025-50181)","summary":"A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration …","severity":"medium","cvss":5.3,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","cvssSource":"vendor","cwe":"CWE-601","vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","affected":["assisted_installer_for_red_hat_openshift_container_platform 2","builds_for_red_hat_openshift","cert_manager_operator_for_red_hat_openshift","confidential_compute_attestation","custom_metric_autoscaler_operator_for_red_hat_openshift","migration_toolkit_for_virtualization","multiarch_tuning_operator","network_observability_operator","openshift_lightspeed","openshift_pipelines","openshift_serverless","openshift_service_mesh 3","ai_inference_server","ansible_automation_platform 2","ceph_storage 6","developer_hub","discovery 1","edge_manager_preview","enterprise_linux 10","enterprise_linux 7","enterprise_linux 8","enterprise_linux 9","enterprise_linux_ai_rhel_ai","offline_knowledge_portal","openshift_ai_rhoai","openshift_container_platform 4","satellite 6","trusted_artifact_signer","ceph_storage 7.1","ceph_storage 8.1","ceph_storage 9","quay 3.14"],"patched":["ceph_storage 7.1","ceph_storage 8.1","ceph_storage 9","quay 3.14"],"published":"2025-06-19","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:11:29+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-50181.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-50181.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-50181"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373799"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-50181"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-50181"},{"url":"https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v"},{"url":"https://access.redhat.com/errata/RHSA-2026:33154"},{"url":"https://access.redhat.com/errata/RHSA-2026:62115"},{"url":"https://access.redhat.com/errata/RHSA-2026:3406"},{"url":"https://access.redhat.com/errata/RHSA-2026:4215"},{"url":"https://github.com/urllib3/urllib3"},{"url":"https://github.com/urllib3/urllib3/releases/tag/2.5.0"}],"tags":["csaf","vex","red-hat","osv","pip"],"epss":0.00474,"epssPercentile":0.4016,"aliases":["GHSA-pq67-6m6q-mj2v","PYSEC-2026-1999"],"ecosystem":"pip","ingestedAt":"2026-07-08T18:25:51.823Z","slug":"CVE-2025-50181","body":"## Overview\n\nA flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass occurs through improper handling of retry parameters during PoolManager instantiation. This issue can reult in a denial of service or unintended data exposure due to altered request destinations.\n\n## Vendor advisories\n\n- **RHSA-2026:33154** · Red Hat · fixed in: Red Hat Ceph Storage 7.1 · released 2026-06-29 · [advisory](https://access.redhat.com/errata/RHSA-2026:33154)\n- **RHSA-2026:62115** · Red Hat · fixed in: Red Hat Ceph Storage 8.1 · released 2026-09-01 · [advisory](https://access.redhat.com/errata/RHSA-2026:62115)\n- **RHSA-2026:3406** · Red Hat · fixed in: Red Hat Ceph Storage 9 · released 2026-02-26 · [advisory](https://access.redhat.com/errata/RHSA-2026:3406)\n- **RHSA-2026:4215** · Red Hat · fixed in: Red Hat Quay 3.14 · released 2026-03-10 · [advisory](https://access.redhat.com/errata/RHSA-2026:4215)\n- **Red Hat VEX** · Moderate · affected: Assisted Installer for Red Hat OpenShift Container Platform 2, Builds for Red Hat OpenShift, cert-manager Operator for Red Hat OpenShift, Confidential Compute Attestation, Custom Metric Autoscaler operator for Red Hat Openshift, Migration Toolkit for Virtualization, … · no fix planned: Assisted Installer for Red Hat OpenShift Container Platform 2, Migration Toolkit for Virtualization, Network Observability Operator, OpenShift Pipelines, … · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-50181.json)\n\n**urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation** — rated Moderate by Red Hat. Released 2025-06-19, updated 2026-09-21.\n\nAffected:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Confidential Compute Attestation\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Migration Toolkit for Virtualization\n- Multiarch Tuning Operator\n- Network Observability Operator\n- OpenShift Lightspeed\n- OpenShift Pipelines\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- Red Hat AI Inference Server\n- Red Hat Ansible Automation Platform 2\n- Red Hat Ceph Storage 6\n- Red Hat Developer Hub\n- Red Hat Discovery 1\n- Red Hat Edge Manager preview\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Enterprise Linux AI (RHEL AI)\n- Red Hat Offline Knowledge Portal\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Satellite 6\n- Red Hat Trusted Artifact Signer\n\nFixed:\n\n- Red Hat Ceph Storage 7.1\n- Red Hat Ceph Storage 8.1\n- Red Hat Ceph Storage 9\n- Red Hat Quay 3.14\n\nNo fix planned:\n\n- Assisted Installer for Red Hat OpenShift Container Platform 2\n- Migration Toolkit for Virtualization\n- Network Observability Operator\n- OpenShift Pipelines\n- Red Hat Ansible Automation Platform 2\n- Red Hat Developer Hub\n- Red Hat Enterprise Linux AI (RHEL AI)\n- Red Hat Trusted Artifact Signer\n- Builds for Red Hat OpenShift\n- cert-manager Operator for Red Hat OpenShift\n- Confidential Compute Attestation\n- Custom Metric Autoscaler operator for Red Hat Openshift\n- Multiarch Tuning Operator\n- OpenShift Lightspeed\n- OpenShift Serverless\n- OpenShift Service Mesh 3\n- Red Hat AI Inference Server\n- Red Hat Discovery 1\n- Red Hat Edge Manager preview\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 7\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n- Red Hat Offline Knowledge Portal\n- Red Hat OpenShift AI (RHOAI)\n- Red Hat OpenShift Container Platform 4\n- Red Hat Satellite 6\n- Red Hat Ceph Storage 6\n\nNot affected:\n\n- Red Hat Ceph Storage 7.1\n- Red Hat Ceph Storage 8.1\n- Red Hat Ceph Storage 9\n- Red Hat Quay 3.14\n- Red Hat build of Quarkus Native builder\n- Red Hat Enterprise Linux 10\n- Red Hat Enterprise Linux 8\n- Red Hat Enterprise Linux 9\n\n## Remediation\n\nThe container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command. https://access.redhat.com/errata/RHSA-2026:33154\nThe container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command. https://access.redhat.com/errata/RHSA-2026:62115\nThe container images provided by this update can be downloaded from the\nRed Hat container registry at registry.redhat.io using the \"podman pull\" command. https://access.redhat.com/errata/RHSA-2026:3406\n\nWorkarounds / mitigations:\n\n- Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\n\n## Package advisory (CVE-2025-50181)\n\nAffected packages:\n\n- `urllib3 < 2.5.0`\n\nPatched in:\n\n- `urllib3 2.5.0`\n\nSource: https://osv.dev/vulnerability/GHSA-pq67-6m6q-mj2v","depth":"sunlit","depthScore":29,"depthScoreParts":{"impact":29.2,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}