CVE-2025-50181
📋 TL;DR
This CVE describes a vulnerability in urllib3 where disabling redirects at the PoolManager level fails to properly mitigate SSRF or open redirect attacks. Applications that rely on this method for security will remain vulnerable to these attacks. Only applications explicitly configuring urllib3's PoolManager with specific retry settings are affected.
💻 Affected Systems
- urllib3
📦 What is this software?
Urllib3 by Python
⚠️ Risk & Real-World Impact
Worst Case
Attackers could bypass SSRF protections to access internal services or perform open redirect attacks, potentially leading to credential theft or further exploitation.
Likely Case
Applications with custom urllib3 configurations that disable redirects for security purposes remain vulnerable to SSRF/open redirect attacks they thought were mitigated.
If Mitigated
If applications use proper network segmentation and input validation, the impact is limited even if the vulnerability is exploited.
🎯 Exploit Status
Exploitation requires the attacker to trigger HTTP requests from the vulnerable application and requires specific application configuration.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.0
Vendor Advisory: https://github.com/urllib3/urllib3/security/advisories/GHSA-pq67-6m6q-mj2v
Restart Required: No
Instructions:
1. Update urllib3 to version 2.5.0 or later using pip: pip install --upgrade urllib3>=2.5.0
2. Verify the update was successful
3. No application restart required for Python libraries
🔧 Temporary Workarounds
Use explicit redirect handling
allInstead of relying on PoolManager configuration, implement explicit redirect validation in application code
🧯 If You Can't Patch
- Implement network-level controls to restrict outbound HTTP connections from vulnerable applications
- Add application-layer validation for all URLs and redirect targets before processing
🔍 How to Verify
Check if Vulnerable:
Check if your application uses urllib3 with custom PoolManager configuration that disables redirects via retry settingsCheck Version:
python -c "import urllib3; print(urllib3.__version__)"Verify Fix Applied:
Verify urllib3 version is 2.5.0 or higher and test that redirect handling works as expected in security contexts📡 Detection & Monitoring
Log Indicators:
- Unexpected outbound HTTP requests to internal or restricted networks
- HTTP redirects being followed despite application intent to block them
Network Indicators:
- HTTP traffic to unexpected destinations from applications using urllib3
SIEM Query:
source="application_logs" AND ("urllib3" OR "PoolManager") AND ("redirect" OR "SSRF")