Read the docs
TI-2026-86148 Aliases CVE-2026-103022

Encoding errors in Urwid web display handler allow denial of service

Priority LOW 24CWE-116Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-248.

Summary

Urwid versions before 4.0.7 are affected. The handle_short_request() function in urwid/display/web.py performs character encoding and decoding without error handling (CWE-116). A remote attacker with a valid X-Urwid-ID session token can send non-ASCII POST data that makes the CGI handler return an error and stop processing the request, and repeated requests leave a file descriptor unclosed, which can cause denial of service for the web display interface.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.

Why it matters now

EPSS 0.00472 41st percentileScored 2026-11-07
Fix Fixed urwid (urwid): 4.0.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
urwidurwidbefore 4.0.74.0.7Patch availableCNA
  • urwid Vendorurwid Affected before 4.0.7 Fixed in 4.0.7 Patch available CNA

Remediation

Update urwid to version 4.0.7, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA urwid (urwid) Fixed in 4.0.7

Timeline

  1. 2026-11-06 Threatist record created from CVE-2026-103022

References

Other 4

  • TI-2026-08183 Insecure PRNG and Information Exposure in urwid Web Display Backend CVSS 4.0CRITICAL 9.2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences