urllib3 handles redirects and retries via the Retry object. While redirects can be disabled per request, disabling redirects globally by setting the 'retries' parameter on PoolManager instantiation is ignored due to this vulnerability. Applications that attempt to mitigate SSRF or open redirect vulnerabilities by disabling redirects at the PoolManager level remain vulnerable because redirects are still followed. The vulnerability affects Locust versions >=2.2.1 and <2.37.10_2. The recommended remediation is to upgrade to a patched urllib3 version and disable redirects at the request level instead of relying on PoolManager-level settings.

Applications using vulnerable versions of Locust that disable redirects at the PoolManager level remain susceptible to SSRF or open redirect exploitation because redirects are not actually disabled. This can lead to unauthorized information disclosure or other impacts related to SSRF attacks. The CVSS 3.1 score is 5.3 (medium severity), reflecting network attack vector, high complexity, low privileges required, no user interaction, unchanged scope, and high confidentiality impact.

Upgrade to a patched version of urllib3 that addresses this issue. Until upgraded, disable redirects explicitly at the request() level rather than relying on the retries parameter during PoolManager instantiation. No other mitigations are indicated by the vendor advisory.