CVE-2025-50181

Medium

Advisory

Published 18 Jun 2025In the index since 5 Sept 2026

Severity: Medium; worst across findings
CVSS: 6.1; base score, highest
EPSS: 0.004; 37th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 760; of 17,790 indexed, latest versions
Container images: 808; deployed by those charts
Fix available: 4 of 4; affected packages

urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation

Carried by container images the latest versions of 760 of 17,790 indexed charts deploy, on 808 images.

Affected package	Affected versions	Fixed in	Images
python-urllib3deb	1.13.1-2ubuntu0.16.04.1, 1.13.1-2ubuntu0.16.04.2, 1.22-1ubuntu0.18.04.1, 1.22-1ubuntu0.18.04.2+9 more	1.13.1-2ubuntu0.16.04.4+esm3, 1.22-1ubuntu0.18.04.2+esm3, 1.25.8-2ubuntu0.4+esm1, 1.26.5-1~exp1ubuntu0.3+1 more	52
urllib3pypi	1.7.1, 1.10.2, 1.13.1, 1.19.1+48 more	2.5.0	798
python-pipdeb	22.0.2+dfsg-1, 22.0.2+dfsg-1ubuntu0.2, 22.0.2+dfsg-1ubuntu0.3, 22.0.2+dfsg-1ubuntu0.4+3 more	22.0.2+dfsg-1ubuntu0.6, 24.0+dfsg-1ubuntu1.2	15
py3-pipapk	25.0.1-r0, 25.2-r0, 26.0.1-r1	26.1.1-r0	3

OSV records: CGA-4hfw-26xr-4q65 CGA-p24r-46cw-ghmg DEBIAN-CVE-2025-50181 GHSA-pq67-6m6q-mj2v UBUNTU-CVE-2025-50181
Also known as: CGA-8wpc-jwj7-w5v8, CGA-qw3g-vj75-jcvc, PYSEC-2026-1999, USN-7599-1, USN-7599-2

Charts affected

760 by stars

Chart

Latest

Affected images

Radar Score

emissary-ingresswenerme

8.12.2

1 of 2 See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
datawire/emissary :3.12.2	1f67a1292d2a	urllib3@2.2.1	2.5.0

Open the chart page →

10,857

juicefs-csi-driverwenerme

0.32.5

1 of 5 See more

juicefs-csi-driver wenerme 0.32.5

1 of the 5 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
juicedata/juicefs-csi-driver :v0.32.5	95008ba63318	urllib3@1.26.12	2.5.0

Open the chart page →

8,824

ceph-csi-cephfswikimedia

0.1.8

1 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	urllib3@1.24.2	2.5.0

Open the chart page →

10,286

ceph-csi-rbdwikimedia

0.1.13

1 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	urllib3@1.24.2	2.5.0

Open the chart page →

11,785

docker-hub-rate-limit-exporterwiremind

0.3.0

1 of 1 See more

docker-hub-rate-limit-exporter wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
viadee/docker-hub-rate-limit-exporter :version-1.5	2e27e3b3ee56	urllib3@1.26.3	2.5.0

Open the chart page →

1,843

marge-botwiremind

1.4.4

1 of 1 See more

marge-bot wiremind 1.4.4

1 of the 1 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
hiboxsystems/marge-bot :0.14.0	dcffb926e563	urllib3@2.0.4	2.5.0

Open the chart page →

5,548

powerdnsadminwitcom-gmbh

0.3.4

1 of 1 See more

powerdnsadmin witcom-gmbh 0.3.4

1 of the 1 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
ngoduykhanh/powerdns-admin :v0.2.4	ba36ab196d3d	urllib3@1.25.11	2.5.0

Open the chart page →

2,643

xkopsxkops

0.1.0

2 of 5 See more

xkops xkops 0.1.0

2 of the 5 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
hamzaarshad10/querybackend :1.6.2	2c1c3b86a8e7	urllib3@2.2.3	2.5.0
hamzaarshad10/querypodpy :1.7	154f38e8668e	urllib3@2.2.3	2.5.0

Open the chart page →

13,197

enterprise-gatewayzeet

3.2.2

1 of 2 See more

enterprise-gateway zeet 3.2.2

1 of the 2 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
elyra/kernel-image-puller :3.2.2	c922f1f1646a	urllib3@1.26.15	2.5.0

Open the chart page →

1,838

zerossl-cert-managerzerossl-cert-manager

0.1.0

1 of 2 See more

zerossl-cert-manager zerossl-cert-manager 0.1.0

1 of the 2 container images this version deploys carry CVE-2025-50181.

Container image	Digest	Package	Fixed in
andreymileshin/zerossl-issuer :v1.0.0	e0825acc9e48	urllib3@2.4.0	2.5.0

Open the chart page →

569

Container images carrying it

808 by charts deploying them

A fixed version is listed for 4 of the 4 affected packages.

Container image	Digest	Package	Fixed in	Used by
registry.gitlab.com/open-forms/forms-catalogue :latest	4eaf9c911f33	urllib3@1.26.7	2.5.0	1
registry.gitlab.com/open-forms/request-registry :latest	0886cbbc5f95	urllib3@1.26.7	2.5.0	1
registry.gitlab.com/radiology/infrastructure/study-governor :8.0.0	4e7faf6f8d5f	urllib3@2.1.0	2.5.0	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	9b9d1ed86b6a	urllib3@1.26.19	2.5.0	1
registry.gitlab.com/xrow-public/helm-iframely/iframely :2.3.5	fcf07d5ff7e2	urllib3@1.26.5	2.5.0	1
registry.gitlab.com/xrow-public/helm-mssql/mssql :1.10.3	f923d842bc47	urllib3@1.26.19	2.5.0	1
registry.gitlab.com/xrow-public/helm-openclaw/openclaw :1.91.3	ed44d81a65de	urllib3@1.26.19	2.5.0	1
registry.gitlab.com/xrow-public/velero-client/velero-client :1.4.2	03015f863a3e	urllib3@1.26.19	2.5.0	1