Red Hat Security Advisory

RHSA-2026:57638

python-urwid security update

Released 2026-08-20 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Enterprise Linux BaseOS AUS (v.8.4) python-urwid-1.3.1-4.el8_4.1, python3-urwid-1.3.1-4.el8_4.1
Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4) python-urwid-1.3.1-4.el8_4.1, python3-urwid-1.3.1-4.el8_4.1

Fixes 1 record

TI-2026-08183 CVE-2026-9323 · GHSA-83x9-8wvq-rrcp

Insecure PRNG and Information Exposure in urwid Web Display Backend

MEDIUM 43

The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not…

CVSS 4.0CRITICAL 9.2 Network No auth No interaction EPSS 0.00715 Published 2026-07-18 Partial fix CWE-338