Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)

published 2026-11-06 2 d ago modified 2026-11-06 2 d ago also EUVD-2026-118521

cvss: 5.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits: 0; none known

Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.

Patch / fix

distros 1 links 3

urwid Debian 14 4.1.3-1

debian advisories DEBIAN-CVE-2026-103022

github.com/urwid/urwid@b79d9a9 commit
github.com/urwid/urwid#1201 pull request
github.com/urwid/urwid/releases/tag/4.0.7 release

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

urwid urwid

Classification

Weakness

CWE-116 Improper Encoding or Escaping of Output
CWE-248 Uncaught Exception
CWE-775 Missing Release of File Descriptor or Handle after Effective Lifetime

References

Sources

CVE List CVE-2026-103022
NVD CVE-2026-103022

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary