Skip to content
OpenAdvisories
High ELSA-2026-58561 1 CVE

Important: python-urwid security update (Oracle Linux 10)

Published Aug 24, 2026 · Updated Aug 24, 2026

Ecosystem: Oracle Linux

Summary

[2.5.3-5]
- Use secure random session identifiers

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 10 python3-urwid 0:2.5.3-4.el10_2.5

Vulnerabilities 1

  • High 8.1
    CVE-2026-9323

    Insecure PRNG and Information Exposure in urwid Web Display Backend

    The urwid web display backend (urwid/display/web.py) generates web session identifiers (urwid_id) in Screen.start() by concatenating two random.randrange(10**9) calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call co…

    urwid urwid python-urwid urwid Debian Ubuntu Azure Linux