CVE-2025-50182

Aliases:GHSA-48p4-8xcf-vxj5PYSEC-2026-1997DEBIAN-CVE-2025-50182CGA-23v3-25f8-99mcCGA-24cp-j5r6-wqm9CGA-2fc6-rmc7-vf79CGA-2gxp-qxfg-jmfmCGA-2h62-g3jm-qr4cCGA-2m32-c3rj-33grCGA-2pc8-fpcc-3pvhCGA-35vm-22g5-c694CGA-37hg-9244-c3g3CGA-3crp-mj7j-4wgpCGA-3pr3-8v9v-9225CGA-3qg2-jqh4-422fCGA-3rj7-9v76-c2rhCGA-3w2p-8x5j-vp3cCGA-427m-qc27-2h32CGA-44gv-prj9-j7p9CGA-46p2-73w5-qjj7CGA-47vf-9xw5-wq82CGA-48c6-qg5j-c55mCGA-48cq-86xj-6jpqCGA-4c25-fmgp-f2xfCGA-4c2x-62cw-jhrgCGA-4cjm-7jgr-gw3wCGA-4m5r-rcpg-g3f4CGA-4qq2-c925-83c7CGA-4rjq-g99h-6fvjCGA-4xvc-rcpg-pc8wCGA-54qw-whcf-5r5fCGA-59r3-375f-g52vCGA-5fqm-95mg-f4x7CGA-5mw6-x8ff-h332CGA-5q9r-wvqj-3wmqCGA-5vpr-x2vj-6w4pCGA-5vv9-f3cg-q222CGA-5wr9-cqx3-mqp6CGA-62g9-3xwp-8p3fCGA-62v9-9qc8-x6rmCGA-68mv-pmv5-7q64CGA-69g6-2qwg-9278CGA-6ch5-mfp6-xf5qCGA-6fmv-rqrw-rhhqCGA-6gjm-6gqq-32ghCGA-6gvr-98qj-g2ghCGA-6h5q-34g7-96mwCGA-6h7w-cr8q-jr7qCGA-6wvp-xfv5-r46fCGA-73h7-8x6p-5mxmCGA-764x-334w-ww94CGA-76x7-wcrf-gq3gCGA-78cc-2r8x-324vCGA-78wc-4c74-4xc6CGA-7g3c-7rwg-56f7CGA-7g5w-mccw-g8vgCGA-7gmr-6w38-f3hmCGA-8335-p8wm-827cCGA-83rq-4j4x-jrh8CGA-85x4-jmfg-hrmxCGA-875f-vf7r-j973CGA-8873-w886-9f6rCGA-8gx5-gcpr-5v3jCGA-8jxr-5cj7-9wx8CGA-8mh8-8h3p-h447CGA-8w4g-whm6-8phqCGA-8wcx-3fjh-h674CGA-946p-v59p-8jv9CGA-94vc-2rxj-v36vCGA-96rc-ggpg-jwj4CGA-982w-76mm-ggmfCGA-9gm6-j9q9-cxv8CGA-9rj9-8644-64f2CGA-c476-j2rj-m9hpCGA-c54x-4xpf-ww6qCGA-c5pg-458f-4hfqCGA-c5qr-h8xg-r5f6CGA-cfgc-p9v9-mp2fCGA-cp5m-g2hv-3cw7CGA-cv46-7pjr-x4p2CGA-f25f-82g3-vj3cCGA-fm8w-wg4r-4p9xCGA-g3ph-5m8j-qxf5CGA-g3pw-jjcc-3f43CGA-g6m6-j895-v4m2CGA-g78p-hwrv-37r2CGA-g8c8-jqhj-vvm9CGA-g9q5-jp5q-jvpgCGA-h4gp-7qvf-3m9rCGA-h679-f6p5-6rv3CGA-h7gp-7hvh-39r8CGA-h9vj-m8g7-frx8CGA-hjwv-5xm8-gp8pCGA-hx5x-f5g2-7rg7CGA-jcjq-4mx7-8hrwCGA-jf64-g4p7-qvq8CGA-jq6r-pvvv-7pvrCGA-jrc2-6qpp-mcpfCGA-m3jf-8grj-78j9CGA-m472-6cv2-8m7pCGA-m47w-4g8h-3wppCGA-m5h8-h6qc-4jxjCGA-mfhq-wjh9-5vhmCGA-mhjq-8cpq-v5h7CGA-mmqw-xg4m-3rg9CGA-mwp4-666x-2hpcCGA-p7xf-rxgh-mmp9CGA-prf8-j3rr-7mrcCGA-pvfq-739v-v432CGA-2pxv-5348-q66fCGA-2rhp-r888-wgf6CGA-3r8v-47m8-2735CGA-43mq-cgv6-4v73CGA-48cp-qr4c-c23pCGA-5xxr-2f8g-24c2CGA-642f-jc85-g6jcCGA-68fv-p9g6-mhwhCGA-6g24-p6c9-2457CGA-6q66-g9q4-4qw8CGA-6vmm-fvg8-wqq9CGA-7278-g834-2h7vCGA-78xp-9q66-ch94CGA-8rgx-p97v-776xCGA-96mg-cg9m-m3w2CGA-99rv-4gmr-w2m9CGA-c9rj-3c2g-5cqgCGA-crvg-w494-mpqjCGA-frj3-qfm4-xj9qCGA-fxff-v3fq-wp4mCGA-g3ch-hjr5-pjh3CGA-h72p-xq53-7c65CGA-h7qm-w769-fhmjCGA-hjw6-3866-8rg2CGA-m4mg-33j2-547cCGA-mcx6-98rv-hv9xCGA-mmv5-g4v8-5qc9CGA-mx8q-3h9v-f763CGA-pmqr-pwcw-xv85CGA-pvp7-gvpw-fmxmCGA-q9vp-g49v-4x7fCGA-qcxc-pvgm-wfggCGA-qgcm-m4ph-84vqCGA-qm2v-q7hj-h926CGA-qpx6-mchm-7vj3CGA-qr38-p94g-wg34CGA-r6xh-gj22-fh7pCGA-r9p3-82h7-xjp6CGA-rc63-4c2v-357mCGA-rjp5-mcqx-966cCGA-rq7h-32xh-h33jCGA-rqh7-j94j-3qhfCGA-v44x-3cqj-xvxhCGA-v4hh-fr5q-hrhpCGA-v69h-v93f-6gqxCGA-v8cv-prjf-7835CGA-v92f-q6v6-ggf6CGA-v92q-57vm-8rvvCGA-vc59-m6h3-cw9qCGA-vff9-v97x-9fr8CGA-vfh9-r6hw-pq7jCGA-vj7h-8vfj-gchfCGA-vv4c-rjh8-9wjvCGA-vxr7-v85m-2pjwCGA-w449-x7vv-h3fqCGA-w64q-8j86-2f7cCGA-w8hw-f8gf-57cqCGA-w932-j5w4-9c4gCGA-wjw5-7jpg-6r9gCGA-wp4p-94w4-7r6gCGA-wrcf-wp43-4jh4CGA-wvhh-3xr2-7vxpCGA-x285-wp63-88rmCGA-x53v-83j4-x5rhCGA-x673-w32x-wfcfCGA-x87q-3gr3-fw6gCGA-xcpx-cv4v-cwxmCGA-xhpc-8phq-jp99CGA-xpr3-m43p-72p2CGA-xrgc-6w59-22jqCGA-xwr5-rxx5-f9hpCGA-xwrx-wp4h-j87f
Advisory lineage Upstream: 0 Downstream: 4
Modified
Published: 19 Jun 2025, 01:42
Last modified:22 Dec 2025, 18:43

Vulnerability Summary

Overall Risk (default)
low
24/100
CVSS Score
6.1 MEDIUM
v3.1 (nvd)
EPSS Score
0.37% LOW
0% probability +0.35%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

19 Jun 2025, 01:42
Published
Vulnerability first disclosed
22 Dec 2025, 18:43
Last Modified
Vulnerability information updated

Description

urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.

CVSS Metrics

  • v3.1•MEDIUM•Score: 5.3CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
  • v3.1•MEDIUM•Score: 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Trends

Current EPSS score: 0.37%• Percentile: 30%

Techniques & Countermeasures

  • CWE-601•URL Redirection to Untrusted Site ('Open Redirect')

    The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.

Affected Systems

  • chainguard•airflow-2

    < 2.11.0-r5

  • chainguard•airflow-2-bitnami-compat

    < 2.11.0-r5

  • chainguard•airflow-2-compat

    < 2.11.0-r5

  • chainguard•airflow-2-iamguarded-compat

    < 2.11.0-r5

  • chainguard•airflow-3

    < 3.0.2-r2

  • chainguard•airflow-3-bitnami-compat

    < 3.0.2-r2

  • chainguard•airflow-3-compat

    < 3.0.2-r2

  • chainguard•airflow-3-iamguarded-compat

    < 3.0.2-r2

  • chainguard•airflow-core-2

    < 2.11.0-r3

  • chainguard•airflow-core-2-compat

    < 2.11.0-r3

  • chainguard•airflow-core-2-oci-entrypoint

    < 2.11.0-r3

  • chainguard•ansible-operator

    < 0

  • chainguard•ansible-operator-compat

    < 0

  • chainguard•apache-beam-python-3.11-sdk

    < 2.65.0-r2

  • chainguard•az

    < 2.74.0-r3

  • chainguard•az-iamguarded-compat

    < 2.74.0-r3

  • chainguard•barman

    < 3.14.1-r0

  • chainguard•barman-cloudnative-pg

    < 3.14.1-r0

  • chainguard•confluent-docker-utils

    < 0.0.162-r1

  • chainguard•dask-gateway

    < 2025.4.0-r1

  • chainguard•dask-gateway-server

    < 2025.4.0-r1

  • chainguard•dask-kubernetes

    < 2025.4.3-r4

  • chainguard•datadog-agent-fips-7.71-core-integrations

    < 7.71.2-r19

  • chainguard•emissary

    < 3.10.0-r6

  • chainguard•emissary-apiext

    < 3.10.0-r6

  • chainguard•emissary-oci-entrypoint

    < 3.10.0-r6

  • chainguard•ggshield

    < 1.43.0-r0

  • chainguard•jupyter-base-notebook

    < 7.4.3-r2

  • chainguard•jupyter-docker-base

    all

  • chainguard•jupyter-docker-stacks

    all | < 7.3.2-r1

  • chainguard•jwt-tool

    < 2.3.0-r2

  • chainguard•k8s-sidecar

    < 1.30.5-r0

  • chainguard•katib-earlystopping

    < 0.19.0-r3 | < 0.19.0-r0

  • chainguard•kserve

    < 0.16.0-r6

  • chainguard•kserve-agent

    < 0.16.0-r6

  • chainguard•kserve-agent-compat

    < 0.16.0-r6

  • chainguard•kserve-manager

    < 0.16.0-r6

  • chainguard•kserve-manager-compat

    < 0.16.0-r6

  • chainguard•kserve-qpext

    < 0.16.0-r6

  • chainguard•kserve-qpext-compat

    < 0.16.0-r6

  • chainguard•kserve-router

    < 0.16.0-r6

  • chainguard•kserve-router-compat

    < 0.16.0-r6

  • chainguard•kserve-storage-controller

    < 0.16.0-r6

  • chainguard•kubeflow-jupyter-web-app

    < 1.10.0-r5

  • chainguard•kubeflow-pipelines

    < 2.5.0-r4

  • chainguard•kubeflow-pipelines-apiserver

    < 2.5.0-r4

  • chainguard•kubeflow-pipelines-cache_server

    < 2.5.0-r4

  • chainguard•kubeflow-pipelines-cache-deployer

    < 2.5.0-r4

  • chainguard•kubeflow-pipelines-cache-deployer-compat

    < 2.5.0-r4

  • chainguard•kubeflow-pipelines-frontend

    < 2.5.0-r4

Showing first 50 affected entries in server-rendered view.

References (9)