CVE-2026-103022

Name of the Vulnerable Software and Affected Versions Urwid versions prior to 4.0.7

Description The handle short request() function in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling update socket output. A remote attacker with a valid X-Urwid-ID session token can submit non-ASCII POST data to trigger a UnicodeEncodeError or non-UTF-8 polling output to trigger a UnicodeDecodeError. These errors cause the CGI handler to return an error and terminate request processing. Additionally, the POST exception path fails to close an opened file descriptor for the duration of the CGI process lifetime, which can lead to a denial of service for the web display interface through repeated requests.

Recommendations Update to version 4.0.7.