https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 17:30:39 +0000 https://cve.radiocsirt.org/vuln/bdu:2025-09791 bdu:2025-09791 https://cve.radiocsirt.org/vuln/bdu:2025-09791 https://cve.radiocsirt.org/vuln/bell-cve-2025-50181 <p><strong>Affected:</strong> Alpaquita:23: py3-urllib3, Alpaquita:stream: py3-urllib3</p> <p><strong>Affected:</strong> Alpaquita:23: py3-urllib3, Alpaquita:stream: py3-urllib3</p> https://cve.radiocsirt.org/vuln/bell-cve-2025-50181 https://cve.radiocsirt.org/vuln/brew-abi3audit-cve-2025-50181 <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:</p> <p>```python resp = urllib3.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;, redirect=False) print(resp.status) # 302 ```</p> <p>However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:</p> <p>```python import urllib3</p> <p>http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above http = urllib3.PoolManager(retries=False) # should return the first response</p> <p>resp = http.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;) ```</p> <p>However, the `retries` parameter is currently ignored, which means all the above examples don&#39;t disable redirects.</p> <p>## Affected usages</p> <p>Passing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.</p> <p>By default, requests and botocore users are not affected.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.</p> <p>## Remediation</p> <p>You can remediate this vulnerability with the following steps:</p> <p>* Upgrade to a patched version of urllib3. If your organization would benefit from the continued supp…</p> <p><strong>Affected:</strong> Homebrew: abi3audit</p> <p>urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:</p> <p>```python resp = urllib3.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;, redirect=False) print(resp.status) # 302 ```</p> <p>However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:</p> <p>```python import urllib3</p> <p>http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above http = urllib3.PoolManager(retries=False) # should return the first response</p> <p>resp = http.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;) ```</p> <p>However, the `retries` parameter is currently ignored, which means all the above examples don&#39;t disable redirects.</p> <p>## Affected usages</p> <p>Passing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.</p> <p>By default, requests and botocore users are not affected.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.</p> <p>## Remediation</p> <p>You can remediate this vulnerability with the following steps:</p> <p>* Upgrade to a patched version of urllib3. If your organization would benefit from the continued supp…</p> https://cve.radiocsirt.org/vuln/brew-abi3audit-cve-2025-50181 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0622 https://cve.radiocsirt.org/vuln/euvd-2026-264251 EUVD-2026-264251 https://cve.radiocsirt.org/vuln/euvd-2026-264251 https://cve.radiocsirt.org/vuln/fkie_cve-2025-50181 <p>urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.</p> <p>urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-50181 https://cve.radiocsirt.org/vuln/ghsa-pq67-6m6q-mj2v <p><strong>Affected:</strong> PyPI: urllib3</p> <p>urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:</p> <p>```python resp = urllib3.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;, redirect=False) print(resp.status) # 302 ```</p> <p>However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:</p> <p>```python import urllib3</p> <p>http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above http = urllib3.PoolManager(retries=False) # should return the first response</p> <p>resp = http.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;) ```</p> <p>However, the `retries` parameter is currently ignored, which means all the above examples don&#39;t disable redirects.</p> <p>## Affected usages</p> <p>Passing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.</p> <p>By default, requests and botocore users are not affected.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.</p> <p>## Remediation</p> <p>You can remediate this vulnerability with the following steps:</p> <p>* Upgrade to a patched version of urllib3. If your organization would benefit from the continued supp…</p> <p><strong>Affected:</strong> PyPI: urllib3</p> <p>urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:</p> <p>```python resp = urllib3.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;, redirect=False) print(resp.status) # 302 ```</p> <p>However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:</p> <p>```python import urllib3</p> <p>http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above http = urllib3.PoolManager(retries=False) # should return the first response</p> <p>resp = http.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;) ```</p> <p>However, the `retries` parameter is currently ignored, which means all the above examples don&#39;t disable redirects.</p> <p>## Affected usages</p> <p>Passing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.</p> <p>By default, requests and botocore users are not affected.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.</p> <p>## Remediation</p> <p>You can remediate this vulnerability with the following steps:</p> <p>* Upgrade to a patched version of urllib3. If your organization would benefit from the continued supp…</p> https://cve.radiocsirt.org/vuln/ghsa-pq67-6m6q-mj2v https://cve.radiocsirt.org/vuln/msrc_cve-2025-50181 msrc_CVE-2025-50181 https://cve.radiocsirt.org/vuln/msrc_cve-2025-50181 https://cve.radiocsirt.org/vuln/oesa-2025-1958 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python-urllib3, openEuler:24.03-LTS-SP2: python-urllib3, openEuler:20.03-LTS-SP4: python-urllib3, openEuler:22.03-LTS-SP3: python-urllib3, openEuler:22.03-LTS-SP4: python-urllib3, openEuler:24.03-LTS: python-urllib3</p> <p>HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):</p> <p>urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP1: python-urllib3, openEuler:24.03-LTS-SP2: python-urllib3, openEuler:20.03-LTS-SP4: python-urllib3, openEuler:22.03-LTS-SP3: python-urllib3, openEuler:22.03-LTS-SP4: python-urllib3, openEuler:24.03-LTS: python-urllib3</p> <p>HTTP library with thread-safe connection pooling, file post support, sanity friendly, and more. Security Fix(es):</p> <p>urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.(CVE-2025-50181)</p> https://cve.radiocsirt.org/vuln/oesa-2025-1958 https://cve.radiocsirt.org/vuln/opensuse-su-2025:15283-1 <p>python311-urllib3-2.5.0-1.1 on GA media</p> <p>python311-urllib3-2.5.0-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2025:15283-1 https://cve.radiocsirt.org/vuln/pysec-2026-1999 <p><strong>Affected:</strong> PyPI: urllib3</p> <p>urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:</p> <p>```python resp = urllib3.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;, redirect=False) print(resp.status) # 302 ```</p> <p>However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:</p> <p>```python import urllib3</p> <p>http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above http = urllib3.PoolManager(retries=False) # should return the first response</p> <p>resp = http.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;) ```</p> <p>However, the `retries` parameter is currently ignored, which means all the above examples don&#39;t disable redirects.</p> <p>## Affected usages</p> <p>Passing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.</p> <p>By default, requests and botocore users are not affected.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.</p> <p>## Remediation</p> <p>You can remediate this vulnerability with the following steps:</p> <p>* Upgrade to a patched version of urllib3. If your organization would benefit from the continued supp…</p> <p><strong>Affected:</strong> PyPI: urllib3</p> <p>urllib3 handles redirects and retries using the same mechanism, which is controlled by the `Retry` object. The most common way to disable redirects is at the request level, as follows:</p> <p>```python resp = urllib3.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;, redirect=False) print(resp.status) # 302 ```</p> <p>However, it is also possible to disable redirects, for all requests, by instantiating a `PoolManager` and specifying `retries` in a way that disable redirects:</p> <p>```python import urllib3</p> <p>http = urllib3.PoolManager(retries=0) # should raise MaxRetryError on redirect http = urllib3.PoolManager(retries=urllib3.Retry(redirect=0)) # equivalent to the above http = urllib3.PoolManager(retries=False) # should return the first response</p> <p>resp = http.request(&#34;GET&#34;, &#34;https://httpbin.org/redirect/1&#34;) ```</p> <p>However, the `retries` parameter is currently ignored, which means all the above examples don&#39;t disable redirects.</p> <p>## Affected usages</p> <p>Passing `retries` on `PoolManager` instantiation to disable redirects or restrict their number.</p> <p>By default, requests and botocore users are not affected.</p> <p>## Impact</p> <p>Redirects are often used to exploit SSRF vulnerabilities. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable.</p> <p>## Remediation</p> <p>You can remediate this vulnerability with the following steps:</p> <p>* Upgrade to a patched version of urllib3. If your organization would benefit from the continued supp…</p> https://cve.radiocsirt.org/vuln/pysec-2026-1999 https://cve.radiocsirt.org/vuln/rhsa-2026:33154 <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools tar-fs: link following and path traversal via maliciously crafted tar file nanoid: nanoid mishandles non-integer values brace-expansion: juliangruber brace-expansion index.js expand redos lodash: prototype pollution in _.unset and _.omit functions golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation ceph: privilege escalation by unprivileged users in a ceph-fuse mounted CephFS tar-fs: tar-fs symlink validation bypass urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)</p> <p>pypa/setuptools: Remote code execution via download functions in the package_index module in pypa/setuptools tar-fs: link following and path traversal via maliciously crafted tar file nanoid: nanoid mishandles non-integer values brace-expansion: juliangruber brace-expansion index.js expand redos lodash: prototype pollution in _.unset and _.omit functions golang.org/x/crypto/ssh/agent: golang.org/x/crypto/ssh/agent: SSH client panic due to unexpected SSH_AGENT_SUCCESS urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation ceph: privilege escalation by unprivileged users in a ceph-fuse mounted CephFS tar-fs: tar-fs symlink validation bypass urllib3: urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)</p> https://cve.radiocsirt.org/vuln/rhsa-2026:33154 https://cve.radiocsirt.org/vuln/suse-su-2025:02736-1 <p>Security update for python-urllib3</p> <p>Security update for python-urllib3</p> https://cve.radiocsirt.org/vuln/suse-su-2025:02736-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-50181 <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:22.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:24.04:LTS: python-pip, Ubuntu:24.04:LTS: python-urllib3</p> <p>urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.</p> <p><strong>Affected:</strong> Ubuntu:Pro:16.04:LTS: python-urllib3, Ubuntu:Pro:18.04:LTS: python-urllib3, Ubuntu:Pro:20.04:LTS: python-urllib3, Ubuntu:22.04:LTS: python-pip, Ubuntu:22.04:LTS: python-urllib3, Ubuntu:24.04:LTS: python-pip, Ubuntu:24.04:LTS: python-urllib3</p> <p>urllib3 is a user-friendly HTTP client library for Python. Prior to 2.5.0, it is possible to disable redirects for all requests by instantiating a PoolManager and specifying retries in a way that disable redirects. By default, requests and botocore users are not affected. An application attempting to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level will remain vulnerable. This issue has been patched in version 2.5.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-50181 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2154 <p>Ein Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in IBM InfoSphere Information Server ausnutzen, um beliebigen Programmcode mit Administratorrechten auszuführen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-2154