AIKIDO-2026-456548
urwid is vulnerable to Denial of Service (DoS)
53
Medium Risk
This Affects:
urwidTL;DR
The handle_short_request() function in the urwid web display backend encodes POST request bodies to ASCII before writing them to a named pipe. A request body containing any non-ASCII byte raises an unhandled UnicodeEncodeError, crashing the CGI process with an HTTP 500, and a file descriptor opened earlier in the same function leaks because it is not closed on the error path. A related polling update path also fails to handle non-UTF-8 socket output, raising an unhandled UnicodeDecodeError. The fix adds exception handling and correct encoding so malformed input no longer crashes the handler or leaks descriptors.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and use the urwid web display (CGI) interface.
Background info
urwid is vulnerable to Denial of Service (DoS) in versions 0.8.0 - 4.0.6.
How to fix this
Upgrade the urwid library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant