What’s Vulnerable › Vulnerabilities

CVE-2026-33332: NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.6% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-03-24 · updated 2026-06-17
• Weakness: CWE-20

Description

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.

Affected products

• zauberzeug nicegui: before 3.9.0 — fixed in 3.9.0

How to fix

Upgrade to a fixed version: zauberzeug nicegui 3.9.0. Check the vendor advisory for mitigations.

References

• https://github.com/zauberzeug/nicegui/commit/9026962b8c4f3f225c98b2fbc35aa6b60cb3495b
• https://github.com/zauberzeug/nicegui/releases/tag/v3.9.0
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w5g8-5849-vj76

Get alerted when CVE-2026-33332 or the next vulnerability affects your stack