Urwid, a Python console user interface library, contains a flaw in handle_short_request() where unguarded character encoding is performed on POST data and unguarded UTF-8 decoding on polling output. An attacker who obtains a valid X-Urwid-ID session token can send non‑ASCII POST content that triggers a UnicodeEncodeError, and/or cause UnicodeDecodeError from polling output. These exceptions result in the CGI handler returning an error and terminating the request, while the POST path also leaves an open file descriptor, allowing repeated requests to exhaust system resources. The principal effect is a denial of service to the web‑display interface; confidentiality or integrity are not directly compromised.

All deployments of Urwid that use the web display interface and invoke handle_short_request() before version 4.0.7 are vulnerable. This includes applications that embed Urwid for console‑based web interaction where a POST request is accepted. Versions 4.0.7 and later contain the fix and are not affected.

The CVSS score of 5.3 indicates moderate severity, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires possession of a valid X-Urwid-ID session token, which may be obtained through other authentication weaknesses or social engineering. Once a token is available, an attacker can repeatedly trigger the denial‑of‑service condition via crafted POST requests, potentially exhausting file descriptors and rendering the interface unavailable. The lack of an EPSS score means current exploitation probability is uncertain, but the presence of a remote trigger and lack of strict input validation make the risk non‑negligible.