CVE-2026-103022

Name	CVE-2026-103022
Description	Urwid is a console user interface library for Python. Prior to 4.0.7, handle_short_request() in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker who obtains a valid X-Urwid-ID session token can submit non-ASCII POST data that raises UnicodeEncodeError, while non-UTF-8 polling output raises UnicodeDecodeError, causing the CGI handler to return an error and terminate request processing. The POST exception path also leaves an opened file descriptor unclosed for the CGI process lifetime, so repeated requests can cause denial of service for the web display interface. This issue is fixed in version 4.0.7.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
urwid (PTS)	bookworm	2.1.2-4	vulnerable
	bookworm (security)	2.1.2-4+deb12u1	vulnerable
	trixie	2.6.16-1	vulnerable
	forky, sid	4.2.5-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
urwid	source	(unstable)	4.1.3-1

Notes

https://github.com/urwid/urwid/security/advisories/GHSA-cp25-j9x5-p5xm
https://github.com/urwid/urwid/pull/1201
Fixed by: https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b (4.0.7)