Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
A GitHub-reviewed security advisory, not necessarily under active exploitation the way our CISA KEV advisories are, but a real, disclosed vulnerability in an open-source dependency.
Affected packages
Vulnerable: <= 4.0.6
Patched in 4.0.7
Details
The handle_short_request() function in urwid/display/web.py raises an unhandled UnicodeEncodeError when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above 0x7F causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process.
A second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled UnicodeDecodeError.
An attacker who observes a valid X-Urwid-ID session token (transmitted in plaintext HTTP response headers) can send repeated POST requests containing non-ASCII bytes to the urwid CGI endpoint. Each malformed request causes the CGI handler to crash with HTTP 500. This results in a Denial of Service (DoS) for legitimate users using the urwid web interface.
urwid <= 4.0.6
Fixed in urwid 4.0.7. Users should upgrade to version 4.0.7 or later.
No direct workaround exists short of disabling the urwid web display interface.
EPSS, exploit probability
Low0.47%
estimated chance of real-world exploitation in the next 30 days, higher than 41.1% of every CVE FIRST.org scores
Refreshed 11/10/2026, via FIRST.org's EPSS model, not CVSS, this measures likelihood of exploitation, not how severe it would be.
Talk to us about this
Find out whether this dependency (or others like it) is actually reachable in your codebase.
Get help patching, or building dependency-scanning into your pipeline going forward.
A secure code review or supply chain review finds this before an advisory does.