Medium, CVSS 5.3PyPIAmendedPublished
Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)
CVE-2026-103022 · GHSA-cp25-j9x5-p5xm
- Affected
- PyPI urwid < 4.0.7
- Fixed in
- 4.0.7· Vendor fix available
- Issue
- The `handle_short_request()` function in `urwid/display/web.py` raises an unhandled `UnicodeEncodeError` when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above `0x7F` causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process. A second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled `UnicodeDecodeError`. Impact An attacker who observes a valid `X-Urwid-ID` session token (transmitted in plaintext HTTP response headers) can send repeated POST requests containing non-ASCII bytes to the `urwid` CGI endpoint. Each malformed request causes the CGI handler to crash…
Recommended action: Upgrade to 4.0.7 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.