urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0, urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself determines redirect behavior. This issue has been patched in version 2.5.0.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0,
    urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide
    runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries
    can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to
    control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself
    determines redirect behavior. This issue has been patched in version 2.5.0. (CVE-2025-50182)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - urllib3 is a user-friendly HTTP client library for Python. Starting in version 2.2.0 and prior to 2.5.0,     urllib3 does not control redirects in browsers and Node.js. urllib3 supports being used in a Pyodide     runtime utilizing the JavaScript Fetch API or falling back on XMLHttpRequest. This means Python libraries     can be used to make HTTP requests from a browser or Node.js. Additionally, urllib3 provides a mechanism to     control redirects, but the retries and redirect parameters are ignored with Pyodide; the runtime itself     determines redirect behavior. This issue has been patched in version 2.5.0. (CVE-2025-50182)

Note that Nessus relies on the presence of the package as reported by the vendor.

The remote Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-7599-1 advisory.

    Jacob Sandum discovered that urllib3 handled redirects even when they were explicitly disabled while using     the PoolManager. An attacker could possibly use this issue to obtain sensitive information.
    (CVE-2025-50181)

    Illia Volochii discovered that urllib3 incorrectly handled retry and redirect parameters when using     Node.js. An attacker could possibly use this issue to obtain sensitive information. This issue only     affected Ubuntu 25.04. (CVE-2025-50182)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
462581	Echo: python-urllib3: security update to 2.3.0-3urllib3: security update to 2.5.0	Tenable Cloud Security	Echo Local Security Checks	Local	medium
462581	Echo: python-urllib3: security update to 2.3.0-3urllib3: security update to 2.5.0	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
248306	Linux Distros Unpatched Vulnerability : CVE-2025-50182	Nessus	Misc.	Local	medium
240700	Ubuntu 16.04 LTS / 18.04 LTS / 20.04 LTS / 22.04 LTS / 24.04 LTS / 24.10 / 25.04 : urllib3 vulnerabilities (USN-7599-1)	Nessus	Ubuntu Local Security Checks	Local	medium
427890	SCA: security update for urllib3 (GHSA-48p4-8xcf-vxj5)	Tenable Cloud Security	SCA Checks	Local	medium
427890	SCA: security update for urllib3 (GHSA-48p4-8xcf-vxj5)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium

Detections

Analytics

CVE-2025-50182

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium