# CVE-2026-103022: Urwid encoding handling denial of service in web display

Source: https://junglewise.ai/threats/cve-2026-103022-urwid-is-a-console-user-interface-library-for-python-prior-to-4  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-06. Updated: 2026-11-06  
License: CC BY 4.0 with a link back

CVE-2026-103022 · Severity: medium · CVSS 5.3 · Published 2026-11-06

Urwid is a Python library for building text-based user interfaces in web browsers. A flaw in its web display handler allows authenticated attackers to submit specially crafted data that causes encoding errors, triggering request failures and resource leaks. Repeated exploitation can exhaust system resources and disrupt the web interface availability.

Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-103022 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-103022 being exploited in the wild.

**How severe is CVE-2026-103022?** Medium severity, with a CVSS score of 5.3, published 6 November 2026.

**Which products and versions are affected?** urwid (PyPI) <= 4.0.6, ECOSYSTEM:introduced=0,fixed=4.0.7; Urwid project Urwid before 4.0.7.

**Is there a fix for CVE-2026-103022?** Yes. urwid (PyPI): upgrade to 4.0.7 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-103022 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-103022?** Check whether you run urwid (PyPI) or Urwid project Urwid at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- urwid (PyPI): upgrade to 4.0.7 or later

  ```sh
  pip install "urwid>=4.0.7"
  ```


## Technical details

The handle_short_request() function in urwid/display/web.py performs unguarded character encoding on POST input and unguarded UTF-8 decoding on polling socket output, raising UnicodeEncodeError and UnicodeDecodeError respectively. An attacker with a valid X-Urwid-ID session token can exploit this by sending non-ASCII POST data or triggering non-UTF-8 output, causing the CGI handler to fail; additionally, file descriptor leaks in the POST exception path enable denial of service through resource exhaustion over repeated requests.

## Affected products

- Urwid project Urwid before 4.0.7

## Identifiers

- CVE-2026-103022
- GHSA-cp25-j9x5-p5xm

## Timeline

- 2026-11-06: disclosed

## References

- [https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b](https://github.com/urwid/urwid/commit/b79d9a96843a6f5950bb2bfab5d059bdc61c538b)
- [https://github.com/urwid/urwid/pull/1201](https://github.com/urwid/urwid/pull/1201)

## Related threats

- [Duplicate Advisory: urwid: Insecure PRNG and Information Exposure in Web Display Backend](https://junglewise.ai/threats/duplicate-advisory-urwid-insecure-prng-and-information-exposure-in-web-f0e7011b)