{"id":"CVE-2026-103022","aliases":["GHSA-cp25-j9x5-p5xm"],"url":"https://o3.security/vulnerability/CVE-2026-103022","summary":"Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)","details":"### Summary\nThe `handle_short_request()` function in `urwid/display/web.py` raises an unhandled `UnicodeEncodeError` when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above `0x7F` causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process.\n\nA second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled `UnicodeDecodeError`.\n\n### Impact\nAn attacker who observes a valid `X-Urwid-ID` session token (transmitted in plaintext HTTP response headers) can send repeated POST requests containing non-ASCII bytes to the `urwid` CGI endpoint. Each malformed request causes the CGI handler to crash with HTTP 500. This results in a Denial of Service (DoS) for legitimate users using the `urwid` web interface.\n\n### Affected Versions\n`urwid <= 4.0.6`\n\n### Patches\nFixed in `urwid 4.0.7`. Users should upgrade to version `4.0.7` or later.\n\n### Workarounds\nNo direct workaround exists short of disabling the `urwid` web display interface.","published":"2026-11-06T21:33:37.028Z","modified":"2026-11-08T02:45:56.612995928Z","cvss":{"score":5.3,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"epss":null,"cisaKev":null,"exploitsKnown":null,"affectedPackages":[{"ecosystem":"PyPI","name":"urwid","fixedVersion":"4.0.7"}],"fix":{"url":"https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b","label":"urwid/urwid@b79d9a9"},"references":[{"type":"WEB","url":"https://github.com/urwid/urwid/releases/tag/4.0.7"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103022.json"},{"type":"ADVISORY","url":"https://github.com/urwid/urwid/security/advisories/GHSA-cp25-j9x5-p5xm"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103022"},{"type":"FIX","url":"https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b"},{"type":"FIX","url":"https://github.com/urwid/urwid/pull/1201"},{"type":"PACKAGE","url":"https://github.com/urwid/urwid"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-11-08T02:45:56.612995928Z"}}