CVE-2026-103022: Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)
Urwid is a console user interface library for Python. Prior to 4.0.7, handleshortrequest() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
urwidto a version that resolves this vulnerability.Fixed in 4.0.7
Event History
Frequently Asked Questions
Which deployments are exposed to this denial of service?
Deployments using Urwid's web display CGI handler are affected prior to version 4.0.7. The issue impacts the web display interface rather than Urwid usage generally.
What does an attacker need to trigger the POST-body crash?
The attacker must obtain a valid X-Urwid-ID session token and submit non-ASCII POST data. This can raise UnicodeEncodeError and terminate processing of the CGI request.
Can repeated exploitation have a cumulative effect?
Yes. The POST exception path leaves an opened file descriptor unclosed for the lifetime of the CGI process, so repeated malicious requests can exhaust file descriptors and deny service to the web display interface.
Are polling requests also affected?
Yes. Non-UTF-8 output on the polling update socket can raise UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing.
What version resolves the issue?
Upgrade Urwid to version 4.0.7, which fixes the unguarded POST encoding and polling-output UTF-8 decoding behavior.