Red Hat Security Advisory

RHSA-2026:57637

python-urwid security update

Released 2026-08-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS E4S (v.8.8) python-urwid-1.3.1-4.el8_8.1, python3-urwid-1.3.1-4.el8_8.1
Red Hat Enterprise Linux BaseOS TUS (v.8.8) python-urwid-1.3.1-4.el8_8.1, python3-urwid-1.3.1-4.el8_8.1

Fixes 1 record

TI-2026-08183 CVE-2026-9323 · GHSA-83x9-8wvq-rrcp

Insecure PRNG and Information Exposure in urwid Web Display Backend

MEDIUM 43

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00715 Published 2026-07-18 Partial fix CWE-338