huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2025-48956: vllm: HTTP header size limit not enforced allows Denial of Service from Unauthenticated requests
Component: vllm
Severity: Important
CWE: CWE-130 (Improper Handling of Length Parameter Inconsistency)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-08-26T14:51:41.716000+00:00

A flaw was found in vLLM. A denial of service (DoS) vulnerability can be triggered by sending a single HTTP GET request with an extremely large X-Forwarded-For header to an HTTP endpoint. This results in server memory exhaustion, potentially leading to a crash or unresponsiveness. The attack does not require authentication, making it exploitable by any remote user.

Statement: This vulnerability is considered Important rather than just Moderate because it enables a complete denial of service with minimal effort from a remote, unauthenticated attacker. Unlike moderate flaws that might require specific conditions, partial access, or complex exploitation chains, here a single oversized HTTP request is sufficient to exhaust server memory and crash the vLLM service. Since vLLM is often deployed as a backend for high-availability inference workloads, this creates a high-impact risk: availability is entirely compromised, all running workloads are disrupted, and recovery may require manual intervention. The lack of authentication barriers makes the attack surface fully exposed over the network, which elevates the severity beyond Moderate to Important.

Affected upstream versions: >= 0.1.0, < 0.10.1.1
Fixed upstream versions: v0.10.1.1
Upstream repository: https://github.com/vllm-project/vllm
Upstream fix commit: d8b736f913a59117803d6701521d2e4861701944
CVE-2025-48964: iputils: iputils integer overflow
Component: iputils
Severity: Moderate
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-07-22T00:00:00+00:00

An integer overflow flaw has been discovered in the ping function within the iputils package. This overflow may allow an attacker to craft an ECHO reply which can prevent iputils from operating normally.


Affected upstream versions: <= 20240905
Fixed upstream versions: 20250602
Upstream repository: https://github.com/iputils/iputils
Upstream fix commit: afa36390394a6e0cceba03b52b59b6d41710608c
CVE-2025-48997: multer: Multer vulnerable to Denial of Service via unhandled exception
Component: multer
Severity: Moderate
CWE: CWE-248 (Uncaught Exception)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Public date: 2025-06-03T18:21:59.527000+00:00

An unhandled exception flaw was found in multer. This issue allows an attacker to trigger an application level denial of service by sending an upload file request with an empty string field name, which triggers an exception in processing that is not properly handled. This issue will lead to a program crash.

Statement: The denial of service impact is limited to the program that integrates multer. The host operating system is not affected.

Affected upstream versions: >= 1.4.4-lts.1, < 2.0.1
Fixed upstream versions: v2.0.1
Upstream repository: https://github.com/expressjs/multer
Upstream fix commit: 35a3272b611945155e046dd5cef11088587635e9
CVE-2025-49091: konsole: Konsole Remote Code Execution Vulnerability
Component: konsole
Severity: Important
CWE: CWE-670 (Always-Incorrect Control Flow Implementation)
CVSS v3: 8.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H)
Public date: 2025-06-11T00:00:00+00:00

A flaw was found in Konsole. The application's handling of URLs using scheme handlers like ssh://, telnet://, or rlogin:// allows a remote attacker to trigger arbitrary code execution. This issue occurs when a user opens a specially crafted URL, bypassing authentication checks. Consequently, a malicious URL can be used to execute commands on the system.

Statement: This vulnerability was rated as an IMPORTANT vulnerability because the Konsole's handling of URLs containing scheme handlers such as ssh://, telnet://, or rlogin://. When a user opens a specially crafted URL, Konsole automatically processes the scheme without adequate validation or authentication enforcement. This behavior allows a remote attacker to craft malicious URLs that can trigger arbitrary command execution on the user’s system, resulting in a severe compromise of system confidentiality, integrity, and availability.

Affected upstream versions: <= v25.04.1
Fixed upstream versions: 25.04.2
Upstream repository: https://invent.kde.org/utilities/konsole
Upstream fix commit: 09d20dea109050b4c02fb73095f327b5642a2b75
CVE-2025-49133: libtpms: Libtpms Out-of-Bounds Read Vulnerability
Component: libtpms
Severity: Moderate
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.9 (CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:C/C:N/I:N/A:H)
Public date: 2025-06-10T19:46:27.397000+00:00

A flaw was found in libtpms. A heap buffer overflow can occur in the `tpms_parse_pssh` function when parsing a malformed Public Signature Key Exchange (PSK) structure. A local attacker can trigger this overflow by providing a crafted PSK structure to the library. This can lead to a denial of service or allow for arbitrary code execution.

Statement: This vulnerability, identified as a potential out-of-bounds read, is triggered by inconsistent parameters within the CryptHmacSign function of the vTPM (virtual Trusted Platform Module). Although the attack is local to the system, it requires user interaction in the form of sending malicious commands to the vTPM. The primary impact is a denial-of-service (DoS) to the virtual machine (VM) by rendering its vTPM unavailable. This prevents the VM from utilizing critical TPM functionality, which can lead to significant operational disruption. While this flaw does not enable arbitrary code execution, the potential for DoS and broader system instability justifies a Moderate severity rating. The requirement for specific user interaction reduces its severity from what would otherwise be an Important classification.

Affected upstream versions: = 0.7.11, = 0.8.9, = 0.9.6, = 0.10.0
Upstream repository: https://github.com/stefanberger/libtpms
Upstream fix commit: 04b2d8e9afc0a9b6bffe562a23e58c0de11532d1
CVE-2025-49146: pgjdbc: pgjdbc insecure authentication in channel binding
Component: pgjdbc
Severity: Important
CWE: CWE-287 (Improper Authentication)
CVSS v3: 8.2 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N)
Public date: 2025-06-11T14:32:39.348000+00:00

A connection handling flaw was found in the pgjdbc connection driver in configurations that require channel binding. Connections created with authentication methods that should not allow channel binding permit connections to use channel binding. This flaw allows attackers to position themselves in the middle of a connection and intercept the connection.


Affected upstream versions: >= 42.7.4, < 42.7.7
Fixed upstream versions: REL42.7.7
Upstream repository: https://github.com/pgjdbc/pgjdbc
Upstream fix commit: 9217ed16cb2918ab1b6b9258ae97e6ede244d8a0
CVE-2025-49175: xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Out-of-Bounds Read in X Rendering Extension Animated Cursors
Component: xorg-x11-server-Xwayland
Severity: Important
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2025-06-17T00:00:00+00:00

A flaw was found in the X Rendering extension's handling of animated cursors. If a client provides no cursors, the server assumes at least one is present, leading to an out-of-bounds read and potential crash.

Statement: This vulnerability is rated as an important severity because the flaw exists in the X Rendering extension of the X.Org X server, specifically in the handling of animated cursors, when a client request provides zero cursors, the server erroneously assumes that at least one cursor is present and proceeds to access elements in the non-existent array. This logic error causes an out-of-bounds read, which can lead to a server crash and denial of service, the flaw could expose limited uninitialized memory, potentially resulting in minor information disclosure.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.1.0-25.el6_10.1, 0:1.11.0-22.el9_0.15, 0:1.11.0-8.el8_4.13, 0:1.12.0-14.el9_2.12, 0:1.12.0-15.el8_8.14, 0:1.12.0-6.el8_6.14, 0:1.13.1-8.el9_4.7, 0:1.14.1-8.el9_6, 0:1.15.0-7.el8_10, 0:1.20.10-2.el8_4, 0:1.20.11-11.el9_0, 0:1.20.11-16.el8_8, 0:1.20.11-18.el9_2, 0:1.20.11-26.el8_10, 0:1.20.11-26.el9_4, 0:1.20.11-31.el9_6, 0:1.20.11-5.el8_6.3, 0:1.20.4-32.el7_9, 0:1.20.6-4.el8_2, 0:1.8.0-17.el7_7.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 0885e0b26225c90534642fe911632ec0779eebee
CVE-2025-49176: xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in Big Requests Extension
Component: xorg-x11-server-Xwayland
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H)
Public date: 2025-06-17T00:00:00+00:00

A flaw was found in the Big Requests extension. The request length is multiplied by 4 before checking against the maximum allowed size, potentially causing an integer overflow and bypassing the size check.

Statement: This vulnerability is rated as an important severity because this flaw exists in the Big Requests extension of the X.Org X server, where the length of client requests is multiplied by 4 before validating against the maximum allowed size. This computation can cause an integer overflow when a sufficiently large length value is provided, resulting in a wrapped-around total length that appears valid to the size check logic, leading to out-of-bounds memory access, successful exploitation can cause denial of service by crashing the server and may permit memory corruption, compromising system integrity and availability.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.1.0-25.el6_10.1, 0:1.11.0-22.el9_0.15, 0:1.11.0-8.el8_4.13, 0:1.12.0-14.el9_2.12, 0:1.12.0-15.el8_8.14, 0:1.12.0-6.el8_6.14, 0:1.13.1-8.el9_4.7, 0:1.14.1-8.el9_6, 0:1.15.0-7.el8_10, 0:1.20.10-2.el8_4, 0:1.20.11-11.el9_0, 0:1.20.11-16.el8_8, 0:1.20.11-18.el9_2, 0:1.20.11-26.el8_10, 0:1.20.11-26.el9_4, 0:1.20.11-31.el9_6, 0:1.20.11-5.el8_6.3, 0:1.20.4-32.el7_9, 0:1.20.6-4.el8_2, 0:1.8.0-17.el7_7.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 03731b326a80b582e48d939fe62cb1e2b10400d9
CVE-2025-49177: xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Data Leak in XFIXES Extension's XFixesSetClientDisconnectMode
Component: xorg-x11-server-Xwayland
Severity: Important
CWE: CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
CVSS v3: 6.1 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:L)
Public date: 2025-06-17T00:00:00+00:00

A flaw was found in the XFIXES extension. The XFixesSetClientDisconnectMode handler does not validate the request length, allowing a client to read unintended memory from previous requests.

Statement: This vulnerability is rated as an important severity because the flaw exists in the XFIXES extension, specifically in the XFixesSetClientDisconnectMode handler. The handler does not validate the request length field correctly, allowing a client to read beyond the intended bounds of the input buffer. This flaw can result in disclosure of uninitialized memory contents from prior operations, potentially exposing sensitive information from other clients or internal server state. While this issue primarily affects confidentiality, it may also impact availability if the invalid read leads to a crash.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.20.11-31.el9_6, 0:22.1.9-6.el9_4, 0:23.2.7-4.el9_6, 0:24.1.5-4.el10_0, 24.1.7
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: ab02fb96b1c701c3bb47617d965522c34befa6af
CVE-2025-49178: xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Unprocessed Client Request Due to Bytes to Ignore
Component: xorg-x11-server-Xwayland
Severity: Moderate
CWE: CWE-667 (Improper Locking)
CVSS v3: 5.5 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-06-17T00:00:00+00:00

A flaw was found in the X server's request handling. Non-zero 'bytes to ignore' in a client's request can cause the server to skip processing another client's request, potentially leading to a denial of service.

Statement: This vulnerability is rated as a moderate severity because the flaw exists in the X server’s request handling logic, where the “bytes to ignore” field in a client request is not properly validated. A malicious client can submit a request specifying a non-zero 'bytes to ignore' value that exceeds the actual request size, causing the server to advance its internal input pointer incorrectly. As a result, the server may skip over pending requests from other clients, disrupting normal processing and effectively denying service to legitimate users. This vulnerability primarily impacts system availability

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.1.0-25.el6_10.1, 0:1.11.0-22.el9_0.15, 0:1.11.0-8.el8_4.13, 0:1.12.0-14.el9_2.12, 0:1.12.0-15.el8_8.14, 0:1.12.0-6.el8_6.14, 0:1.13.1-8.el9_4.7, 0:1.14.1-8.el9_6, 0:1.15.0-7.el8_10, 0:1.20.10-2.el8_4, 0:1.20.11-11.el9_0, 0:1.20.11-16.el8_8, 0:1.20.11-18.el9_2, 0:1.20.11-26.el8_10, 0:1.20.11-26.el9_4, 0:1.20.11-31.el9_6, 0:1.20.11-5.el8_6.3, 0:1.20.4-32.el7_9, 0:1.20.6-4.el8_2, 0:1.8.0-17.el7_7.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: d55c54cecb5e83eaa2d56bed5cc4461f9ba318c2
CVE-2025-49179: xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer overflow in X Record extension
Component: xorg-x11-server-Xwayland
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.3 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H)
Public date: 2025-06-17T00:00:00+00:00

A flaw was found in the X Record extension. The RecordSanityCheckRegisterClients function does not check for an integer overflow when computing request length, which allows a client to bypass length checks.

Statement: This vulnerability is rated as an important severity because the flaw exists in the X Record extension of the X.Org X server within the RecordSanityCheckRegisterClients function, which fails to validate integer overflows when calculating the length of client registration requests. As a result, the server may read or write beyond intended memory bounds, leading primarily to denial of service by crashing the process, possibility of leaking memory contents or corrupting data.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.1.0-25.el6_10.1, 0:1.11.0-22.el9_0.15, 0:1.11.0-8.el8_4.13, 0:1.12.0-14.el9_2.12, 0:1.12.0-15.el8_8.14, 0:1.12.0-6.el8_6.14, 0:1.13.1-8.el9_4.7, 0:1.14.1-8.el9_6, 0:1.15.0-7.el8_10, 0:1.20.10-2.el8_4, 0:1.20.11-11.el9_0, 0:1.20.11-16.el8_8, 0:1.20.11-18.el9_2, 0:1.20.11-26.el8_10, 0:1.20.11-26.el9_4, 0:1.20.11-31.el9_6, 0:1.20.11-5.el8_6.3, 0:1.20.4-32.el7_9, 0:1.20.6-4.el8_2, 0:1.8.0-17.el7_7.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 2bde9ca49a8fd9a1e6697d5e7ef837870d66f5d4
CVE-2025-49180: xorg-x11-server-Xwayland: xorg-x11-server: tigervnc: Integer Overflow in X Resize, Rotate and Reflect (RandR) Extension
Component: xorg-x11-server-Xwayland
Severity: Important
CWE: CWE-190 (Integer Overflow or Wraparound)
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-06-17T00:00:00+00:00

A flaw was found in the RandR extension, where the RRChangeProviderProperty function does not properly validate input. This issue leads to an integer overflow when computing the total size to allocate.

Statement: This flaw is rated as an important severity because this flaw exists in the RandR extension of the X.Org X server within the RRChangeProviderProperty function, which fails to validate input lengths properly, leads to an integer overflow when calculating the total memory size required for allocation. As a result, subsequent memory operations may write outside the bounds of the allocated buffer, potentially causing memory corruption, application crashes, or arbitrary code execution under certain conditions.

Affected upstream versions: <= DRM-20051017
Fixed upstream versions: 0:1.1.0-25.el6_10.1, 0:1.11.0-22.el9_0.15, 0:1.11.0-8.el8_4.13, 0:1.12.0-14.el9_2.12, 0:1.12.0-15.el8_8.14, 0:1.12.0-6.el8_6.14, 0:1.13.1-8.el9_4.7, 0:1.14.1-8.el9_6, 0:1.15.0-7.el8_10, 0:1.20.10-2.el8_4, 0:1.20.11-11.el9_0, 0:1.20.11-16.el8_8, 0:1.20.11-18.el9_2, 0:1.20.11-26.el8_10, 0:1.20.11-26.el9_4, 0:1.20.11-31.el9_6, 0:1.20.11-5.el8_6.3, 0:1.20.4-32.el7_9, 0:1.20.6-4.el8_2, 0:1.8.0-17.el7_7.1
Upstream repository: https://gitlab.freedesktop.org/xorg/xserver
Upstream fix commit: 3c3a4b767b16174d3213055947ea7f4f88e10ec6
CVE-2025-49574: io.quarkus/quarkus-vertx: Quarkus potential data leak
Component: io.quarkus/quarkus-vertx
Severity: Moderate
CWE: CWE-668 (Exposure of Resource to Wrong Sphere)
CVSS v3: 6.4 (CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2025-06-23T19:47:05.454000+00:00

A data leak vulnerability has been discovered in the io.quarkus:quarkus-vertx package. This flaw can lead to information disclosure if a Vert.x context that has already been duplicated is subsequently duplicated again. In such a scenario, sensitive data residing within that context may be unintentionally exposed.


Affected upstream versions: >= 3.21.0.CR1, < 3.24.1, >= 3.16.0.CR1, < 3.20.2, < 3.15.6
Fixed upstream versions: 3.25.0
Upstream repository: https://github.com/quarkusio/quarkus
Upstream fix commit: 2b58f59f4bf0bae7d35b1abb585b65f2a66787d1
CVE-2025-49844: Redis: Redis Lua Use-After-Free may lead to remote code execution
Component: Redis
Severity: Important
CWE: CWE-416 (Use After Free)
CVSS v3: 8.8 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2025-10-03T19:27:23.609000+00:00

A vulnerability found in Redis where a flaw in the Lua scripting engine can trigger a use-after-free condition. An authenticated attacker can exploit this by running a specially crafted Lua script, potentially resulting in remote code execution (RCE) within the Redis process.

Statement: This vulnerability should be rated Important rather than Moderate because it introduces a memory-safety defect in Redis’s Lua subsystem that can be weaponized for remote code execution (RCE). An authenticated actor with permission to run Lua can craft scripts that trigger a use-after-free in the parser/stack-management code, giving precise control over freed memory and enabling arbitrary code execution inside the redis-server process. That risk is fundamentally different from a typical moderate issue (e.g., a crash or limited denial-of-service): successful exploitation directly compromises the server runtime and all in-memory contents—cached data, session tokens, and application state—rather than merely disrupting service. Because Redis commonly runs with elevated privileges and is a trusted core component in application architectures, an RCE in the server process undermines confidentiality, integrity, and availability across dependent services. Authenticated attackability, trivial exploitation via standard commands (EVAL/EVALSHA), and the potential for full-process compromise elevate CVE-2025-49844 to Important severity.

This flaw exists only in the Redis server implementation; 

Redis client libraries (Python, Node.js, Rust, etc.) are not affected by this vulnerability, and it only exists in the Redis server’s embedded Lua engine where scripts execute. Client libraries merely transmit EVAL/EVALSHA to the server.


Red Hat Satellite does not ship the Redis server, and the Redis client libraries it includes (such as python-redis, python-aioredis and rubygem-redis) are not impacted by this vulnerability. While Satellite consume the Redis package from the underlying RHEL system, which is affected, the Redis service in Satellite is bound only to the local interface and is accessible solely by internal components like Pulp and Dynflow. Since vulnerability requires sending crafted Lua payloads to the Redis command interface, and no external or untrusted clients can connect, the effective exposure within Satellite is nullified.

Affected upstream versions: < 8.2.2
Fixed upstream versions: 8.2.2
Upstream repository: https://github.com/redis/redis
Upstream fix commit: d5728cb5795c966c5b5b1e0f0ac576a7e69af539
CVE-2025-50181: urllib3: urllib3 redirects are not disabled when retries are disabled on PoolManager instantiation
Component: urllib3
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-06-19T01:08:00.340000+00:00

A flaw was found in urllib3. The `PoolManager` class allows redirects to be disabled by configuring retries in a specific manner, effectively bypassing intended HTTP redirection behavior. A network attacker can leverage this configuration to manipulate request flows and disrupt service. This bypass occurs through improper handling of retry parameters during PoolManager instantiation. This issue can reult in a denial of service or unintended data exposure due to altered request destinations.

Statement: A flaw was found in the urllib3 library where it could be tricked into disclosing the Proxy-Authorization header to a destination server when a CONNECT tunnel is used. An attacker can set up a malicious redirect to a crafted URL, which, when followed by the client application, will cause the Proxy-Authorization header to be sent to the attacker-controlled server. This leaks sensitive credentials for the proxy. The impact is primarily on confidentiality. While urllib3 is a ubiquitous component, the vulnerability requires a specific scenario where a user is connecting to a proxy that requires authentication and is redirected to a malicious endpoint. This lowers the exploitability compared to a direct, unauthenticated remote attack, thus, warranting a Moderate severity rating.

Affected upstream versions: < 2.5.0
Fixed upstream versions: 2.5.0
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: f05b1329126d5be6de501f9d1e3e36738bc08857
CVE-2025-50182: urllib3: urllib3 does not control redirects in browsers and Node.js
Component: urllib3
Severity: Moderate
CWE: CWE-601 (URL Redirection to Untrusted Site ('Open Redirect'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N)
Public date: 2025-06-19T01:42:44.921000+00:00

A flaw was found in urllib3. The library fails to properly validate redirect URLs, allowing an attacker to manipulate redirect chains when used in environments like Pyodide utilizing the JavaScript Fetch API. This lack of validation can enable a remote attacker to control the redirect destination, leading to arbitrary URL redirection. Consequently, an attacker can redirect users to malicious websites. This 
vulnerability stems from a failure to constrain the redirect target.

Statement: The vulnerability lies in the urllib3 library's inability to control HTTP redirects when executed within a Pyodide runtime. This can lead to Server-Side Request Forgery (SSRF) attacks, where an attacker can induce the application to make requests to unintended internal or external resources. While urllib3 is a ubiquitous library in the Python ecosystem and is present in many Red Hat products, the vulnerability is specific to its use within the less common Pyodide (Python in a browser) environment. The attack complexity is high as it requires a specific application context where user-supplied input is used to construct a request URL in a Pyodide-based application that also attempts to mitigate SSRF by disabling redirects. The impact is primarily on confidentiality, as a successful exploit could lead to the disclosure of sensitive information from the server's local network. Given the specific and less common configuration required for exploitation, the severity is rated as Moderate.

Affected upstream versions: >= 2.2.0, < 2.5.0
Fixed upstream versions: 2.5.0
Upstream repository: https://github.com/urllib3/urllib3
Upstream fix commit: 7eb4a2aafe49a279c29b6d1f0ed0f42e9736194f