Vulnerability GHSA-cp25-j9x5-p5xm
Summary
Urwid: handle_short_request() crashes on non-ASCII POST body (UnicodeEncodeError DoS)
Details
Summary
The handle_short_request() function in urwid/display/web.py raises an unhandled UnicodeEncodeError when processing a POST request body containing non-ASCII bytes. The function reads POST input and encodes it to ASCII before writing to a named pipe. Any byte value above 0x7F causes the CGI process to exit with an unhandled exception, returning an HTTP 500 error to the client. Additionally, a file descriptor opened earlier in the same function is not closed before the exception propagates, causing a file descriptor leak for the lifetime of the CGI process.
A second instance of missing exception handling exists in the polling update path, where non-UTF-8 socket output causes an unhandled UnicodeDecodeError.
Impact
An attacker who observes a valid X-Urwid-ID session token (transmitted in plaintext HTTP response headers) can send repeated POST requests containing non-ASCII bytes to the urwid CGI endpoint. Each malformed request causes the CGI handler to crash with HTTP 500. This results in a Denial of Service (DoS) for legitimate users using the urwid web interface.
Affected Versions
urwid <= 4.0.6
Patches
Fixed in urwid 4.0.7. Users should upgrade to version 4.0.7 or later.
Workarounds
No direct workaround exists short of disabling the urwid web display interface.
