Skip to content
Fencer Intel
medium 5.3

CVE-2026-103022 json

Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)

published 3d ago modified 4h ago also EUVD-2026-118521 , GHSA-cp25-j9x5-p5xm

cvss
5.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 41%
public exploits
0
none known

Summary

Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.

Patch / fix

  • pypi urwid 4.0.7
  • urwid Debian 14 4.1.3-1

debian advisories DEBIAN-CVE-2026-103022

Is CVE-2026-103022 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Exploit prediction

0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by version score vector
CNA 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem package affected fixed in
pypi urwid
<4.0.7
4.0.7

Affected products

  • urwid urwid

Classification

Weakness
  • CWE-116 Improper Encoding or Escaping of Output
  • CWE-248 Uncaught Exception
  • CWE-775 Missing Release of File Descriptor or Handle after Effective Lifetime

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.