UBUNTU-CVE-2026-103022: Medium severity ubuntu/urwid vulnerability
Urwid is a console user interface library for Python. Prior to 4.0.7, handleshortrequest() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
urwidto a version that resolves this vulnerability.Fixed in 4.0.7
Event History
Frequently Asked Questions
What must an attacker have to trigger the denial of service?
The attacker must obtain a valid X-Urwid-ID session token. They can then send non-ASCII POST data or cause non-UTF-8 polling output to reach the web display CGI handler.
What is the operational impact of repeated exploitation?
Malformed POST requests can raise UnicodeEncodeError and leave an opened file descriptor unclosed for the lifetime of the CGI process. Repeated requests can exhaust resources and deny service to the web display interface.
Which version contains the fix?
The issue is fixed in Urwid version 4.0.7. Versions prior to 4.0.7 are affected according to the provided advisory.