Advisory Database
  • Advisories
  • Dependency Scanning
  1. pypi
  2. ›
  3. urwid
  4. ›
  5. CVE-2026-103022

CVE-2026-103022: Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)

November 9, 2026

The handle_short_request() function in urwid/display/web.py raises an unhandled UnicodeEncodeError when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above 0x7F causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process.

A second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled UnicodeDecodeError.

References

  • github.com/advisories/GHSA-cp25-j9x5-p5xm
  • github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b
  • github.com/urwid/urwid/pull/1201
  • github.com/urwid/urwid/releases/tag/4.0.7
  • github.com/urwid/urwid/security/advisories/GHSA-cp25-j9x5-p5xm
  • nvd.nist.gov/vuln/detail/CVE-2026-103022

Code Behaviors & Features

Detect and mitigate CVE-2026-103022 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →

Affected versions

All versions before 4.0.7

Fixed versions

  • 4.0.7

Solution

Upgrade to version 4.0.7 or above.

Impact 5.3 MEDIUM

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Learn more about CVSS

Weakness

  • CWE-116: Improper Encoding or Escaping of Output
  • CWE-248: Uncaught Exception
  • CWE-775: Missing Release of File Descriptor or Handle after Effective Lifetime

Source file

pypi/urwid/CVE-2026-103022.yml

Spotted a mistake? Edit the file on GitLab.

  • Site Repo
  • About GitLab
  • Terms
  • Privacy Statement
  • Contact

Page generated Tue, 10 Nov 2026 12:16:03 +0000.