CVE-2026-33332 in zauberzeug nicegui

Sumário (Inglês)

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.

Responsável

GitHub_M

Reservar

18/03/2026

Divulgação

24/03/2026

Inscrições

VulDB provides additional information and datapoints for this CVE:

ID	Vulnerabilidade	CWE	Exp	Con	CVE
352867	zauberzeug nicegui Query Parameter app.add_media_files Negação de Serviço	404	Não definido	Correção oficial	CVE-2026-33332