NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.
Summary
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| zauberzeug | nicegui | before 3.9.0 | 3.9.0 | Patch available | CNA |
| — | nicegui (PyPI) | before 3.9.0 | 3.9.0 | Patch available | GHSA-w5g8-5849-vj76 |
- nicegui Vendorzauberzeug Affected before 3.9.0 Fixed in 3.9.0 Patch available CNA
- nicegui (PyPI) Vendor— Affected before 3.9.0 Fixed in 3.9.0 Patch available GHSA-w5g8-5849-vj76
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:zauberzeug:nicegui:*:*:*:*:*:*:*:* | before 3.9.0 | Vulnerable | zauberzeug |
- cpe:2.3:a:zauberzeug:nicegui:*:*:*:*:*:*:*:* Versions before 3.9.0 Vulnerable ·zauberzeug
Remediation
- Fix · CNA nicegui (zauberzeug) Fixed in 3.9.0
- Fix · GHSA-w5g8-5849-vj76 nicegui (PyPI) Fixed in 3.9.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2026-33332
- 2026-10-03 Alias added: GHSA-w5g8-5849-vj76
- 2026-10-25 EPSS moved to the below the 50th percentile
- 2026-11-06 EPSS moved to the 50th–90th percentile
References
Advisory 2
More zauberzeug Nicegui vulnerabilities
- TI-2025-41029 NiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File Reading CVSS 3.1HIGH 7.5
- TI-2026-17574 Zero-click XSS in all NiceGUI apps which uses `ui.sub_pages` CVSS 3.1HIGH 7.2
- TI-2026-17575 NiceGUI has Redis connection leak via tab storage causes service degradation CVSS 3.1MEDIUM 5.3
- TI-2026-17573 NiceGUI apps are vulnerable to XSS which uses `ui.sub_pages` and render arbitrary user-provided links CVSS 3.1MEDIUM 6.1
- TI-2026-17572 NiceGUI is vulnerable to XSS via Unescaped URL in ui.navigate.history.push() / replace() CVSS 3.1MEDIUM 6.1
- TI-2025-40897 NiceGUI Stored/Reflected XSS in ui.interactive_image via unsanitized SVG content CVSS 3.1MEDIUM 6.1
Sources
- CVE-2026-33332 · CVE Program
- CVE-2026-33332 · NVD
- FIRST EPSS
- GHSA-w5g8-5849-vj76 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences