Resource exhaustion in Zauberzeug Nicegui
CVE-2026-33332
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H.
EPSS exploit prediction
EPSS: 0.007 (50.9th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 51st percentile — 50.9% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.006 · newest: 0.007 · change: +0.001
Affected products
- Zauberzeug Nicegui — versions < 3.9.0
Weakness classification (CWE)
References
- github.com/zauberzeug/nicegui/security/advisories/GHSA-w5g8-5849-vj76 (Mitigation, Vendor Advisory)
- github.com/zauberzeug/nicegui/commit/9026962b8c4f3f225c98b2fbc35aa6b60cb3495b (Patch)
- github.com/zauberzeug/nicegui/releases/tag/v3.9.0 (Product, Release Notes)
Frequently asked questions
- What is CVE-2026-33332?
- CVE-2026-33332 is a high-severity vulnerability in Zauberzeug Nicegui, classified under Improper Input Validation. CVSS score: 7.5/10. Published 2026-03-24.
- How severe is CVE-2026-33332?
- High severity. CVSS v3 base score is 7.5 out of 10.