{"id":"CVE-2026-103022","aliases":["AZL-113110","DEBIAN-CVE-2026-103022","EUVD-2026-118521","GHSA-cp25-j9x5-p5xm","UBUNTU-CVE-2026-103022"],"status":"published","title":"Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)","description":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00472,"percentile":0.41327,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-116","CWE-248","CWE-775"],"published":"2026-11-06T21:33:37Z","modified":"2026-11-11T14:17:31Z","fixes":[{"ecosystem":"PyPI","package":"urwid","fixed_in":["4.0.7"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"urwid","fixed_in":["4.1.3-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.0.6"},{"fixed":"4.0.7"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"2.6.14-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2-4","2.1.2-4+deb12u1","2.1.2-4.1","2.1.2-4.2","2.3.4-0.1","2.4.1-0.1","2.4.1-0.2","2.4.6-0.1","2.5.2-1","2.6.10-1","2.6.14-1","2.6.15-1","2.6.16-1","2.6.4-1","3.0.4-1","4.1.3-1","4.2.1-1","4.2.5-1"]},{"source":"osv","ecosystem":"Debian:13","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.16-1","3.0.4-1","4.1.3-1","4.2.1-1","4.2.5-1"]},{"source":"osv","ecosystem":"Debian:14","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.3-1"}]}],"versions":["2.6.16-1","3.0.4-1"]},{"source":"osv","ecosystem":"PyPI","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.7"}]}],"versions":["0.8.0","0.8.1","0.8.10","0.8.2","0.8.3","0.8.4","0.8.5","0.8.6","0.8.7","0.8.8","0.8.9","0.9.0","0.9.0-pre2","0.9.0-pre3","0.9.1","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.7.2","0.9.8","0.9.8.2","0.9.8.3","0.9.8.4","0.9.9","0.9.9.1","0.9.9.2","1.0.0","1.0.1","1.0.2","1.1.0","1.1.1","1.1.2","1.2.0","1.2.1","1.2.2","1.3.0","1.3.1","2.0.0","2.0.1","2.1.0","2.1.1","2.1.2","2.2.0","2.2.1","2.2.2","2.2.3","2.3.4","2.4.0","2.4.1","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.5.0","2.5.1","2.5.2","2.5.3","2.6.0","2.6.0.post0","2.6.1","2.6.10","2.6.11","2.6.12","2.6.13","2.6.14","2.6.15","2.6.16","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","3.0.0","3.0.1","3.0.2","3.0.3","3.0.4","3.0.5","4.0.0","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.2.1-2build1","1.3.0-2","1.3.1-2","1.3.1-2build1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.3.1-2ubuntu2","2.0.1-2","2.0.1-2ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.0.1-2build2","2.0.1-2build3","2.0.1-2build4","2.0.1-3","2.0.1-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2-1build1","2.1.2-1build3","2.1.2-2","2.1.2-2build1","2.1.2-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.1.2-4build1","2.1.2-4.2","2.4.1-0.2","2.4.6-0.1","2.5.2-1","2.6.4-1","2.6.4-1ubuntu1","2.6.10-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["3.0.4-1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:26.04:LTS","package":"urwid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.6.16-1","3.0.4-1","3.0.4-1ubuntu0.1~esm1"]}],"products":[{"vendor":"urwid","product":"urwid"}],"references":[{"url":"https://github.com/urwid/urwid/security/advisories/GHSA-cp25-j9x5-p5xm","tags":["x_refsource_CONFIRM","advisory","web","report"]},{"url":"https://github.com/urwid/urwid/pull/1201","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b","tags":["x_refsource_MISC","fix","web","report"]},{"url":"https://github.com/urwid/urwid/releases/tag/4.0.7","tags":["x_refsource_MISC","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-103022","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-cp25-j9x5-p5xm"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/103xxx/CVE-2026-103022.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-103022","tags":["advisory"]},{"url":"https://github.com/urwid/urwid","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2026-103022","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-103022","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-103022","title":"Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)","description":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.","status":"published","published":"2026-11-06T21:33:37.028Z","modified":"2026-11-11T03:39:17.86Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-116","CWE-248","CWE-775"],"updated_at":"2026-11-06T22:31:26.121Z"}],"euvd":[{"id":"EUVD-2026-118521","description":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.","status":"published","published":"2026-11-06T21:33:37Z","modified":"2026-11-11T03:39:17Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-11T05:26:33.32312Z"}],"ghsa":[{"id":"GHSA-cp25-j9x5-p5xm","title":"Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)","description":"### Summary\nThe `handle_short_request()` function in `urwid/display/web.py` raises an unhandled `UnicodeEncodeError` when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above `0x7F` causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process.\n\nA second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled `UnicodeDecodeError`.\n\n### Impact\nAn attacker who observes a valid `X-Urwid-ID` session token (transmitted in plaintext HTTP response headers) can send repeated POST requests containing non-ASCII bytes to the `urwid` CGI endpoint. Each malformed request causes the CGI handler to crash with HTTP 500. This results in a Denial of Service (DoS) for legitimate users using the `urwid` web interface.\n\n### Affected Versions\n`urwid \u003c= 4.0.6`\n\n### Patches\nFixed in `urwid 4.0.7`. Users should upgrade to version `4.0.7` or later.\n\n### Workarounds\nNo direct workaround exists short of disabling the `urwid` web display interface.","status":"published","published":"2026-11-09T22:05:06Z","modified":"2026-11-09T22:05:08Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-116","CWE-248","CWE-775"],"updated_at":"2026-11-09T22:20:10.289641Z"}],"nvd":[{"id":"CVE-2026-103022","description":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.","status":"published","published":"2026-11-06T22:17:49.92Z","modified":"2026-11-12T22:11:01.153Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-116","CWE-248","CWE-775"],"updated_at":"2026-11-07T00:02:36.552517Z"}],"osv":[{"id":"CVE-2026-103022","title":"Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)","description":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.","status":"published","published":"2026-11-06T21:33:37.028Z","modified":"2026-11-12T02:30:57.148532776Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-116","CWE-248","CWE-775"],"updated_at":"2026-11-08T02:57:30.447698Z"},{"id":"DEBIAN-CVE-2026-103022","description":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.","status":"published","published":"2026-11-06T22:17:49.92Z","modified":"2026-11-11T09:47:37.945385746Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-07T19:21:34.633914Z"},{"id":"GHSA-cp25-j9x5-p5xm","title":"Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)","description":"### Summary\nThe `handle_short_request()` function in `urwid/display/web.py` raises an unhandled `UnicodeEncodeError` when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above `0x7F` causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process.\n\nA second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled `UnicodeDecodeError`.\n\n### Impact\nAn attacker who observes a valid `X-Urwid-ID` session token (transmitted in plaintext HTTP response headers) can send repeated POST requests containing non-ASCII bytes to the `urwid` CGI endpoint. Each malformed request causes the CGI handler to crash with HTTP 500. This results in a Denial of Service (DoS) for legitimate users using the `urwid` web interface.\n\n### Affected Versions\n`urwid \u003c= 4.0.6`\n\n### Patches\nFixed in `urwid 4.0.7`. Users should upgrade to version `4.0.7` or later.\n\n### Workarounds\nNo direct workaround exists short of disabling the `urwid` web display interface.","status":"published","published":"2026-11-09T22:05:06Z","modified":"2026-11-09T22:15:03.936151642Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-116","CWE-248","CWE-775"],"updated_at":"2026-11-09T22:41:08.537457Z"},{"id":"UBUNTU-CVE-2026-103022","description":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.","status":"published","published":"2026-11-09T00:00:00Z","modified":"2026-11-10T02:50:21.565315292Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-10T03:18:57.092165Z"},{"id":"AZL-113110","title":"CVE-2026-103022 affecting package python-urwid 2.6.14-1","description":"Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.","status":"published","published":"2026-11-06T22:17:49Z","modified":"2026-11-11T14:17:31.630901456Z","updated_at":"2026-11-11T14:42:54.020399Z"}]}}