NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
References
History
Tue, 24 Mar 2026 19:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0. | |
| Title | NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion | |
| Weaknesses | CWE-20 CWE-770 |
|
| References |
| |
| Metrics |
cvssV4_0
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2026-03-24T19:20:53.386Z
Reserved: 2026-03-18T22:15:11.812Z
Link: CVE-2026-33332
Vulnrichment
No data.
NVD
Status : Received
Published: 2026-03-24T20:16:28.743
Modified: 2026-03-24T20:16:28.743
Link: CVE-2026-33332
Redhat
No data.
OpenCVE Enrichment
No data.