Weakness in Urwid Console Library for Python Affects Multiple Versions

CVE-2026-103022

What is CVE-2026-103022?

The Urwid console user interface library for Python contains a vulnerability in the handle_short_request() function within urwid/display/web.py that improperly handles character encoding for POST inputs and UTF-8 decoding for output from polling update sockets. This flaw allows a remote attacker, possessing a valid X-Urwid-ID session token, to submit non-ASCII POST data, triggering a UnicodeEncodeError. Additionally, non-UTF-8 responses can cause a UnicodeDecodeError, which ultimately results in request processing termination by the CGI handler. Notably, this situation can leave an open file descriptor during the CGI process’s lifecycle, making the web display interface susceptible to denial of service attacks through repeated requests. The issue has been addressed in version 4.0.7.

References