CVE-2026-33332 json
NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion
published 2026-03-19 7 mo ago modified 2026-07-13 3 mo ago also GHSA-w5g8-5849-vj76 , PYSEC-2026-2233 , EUVD-2026-20086
- cvss
- 7.5
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.6%
- EPSS 0.6% chance of exploitation in 30 days, percentile 50%
- public exploits
- 0
- none known
Summary
NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.
Patch / fix
- pypi nicegui 3.9.0
- zauberzeug nicegui 3.9.0
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 7 mo ago
Exploit prediction
0.62% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N |
| CNA | 4.0 | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L |
| OSV | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| pypi | nicegui | <3.9.0 |
3.9.0 |
Affected products
- zauberzeug nicegui
Classification
References
-
github.com
/zauberzeug/nicegui/commit/9026962b8c4f3f225c98b2fbc35aa6b60cb3495b
web, patch
-
github.com
/zauberzeug/nicegui/security/advisories/GHSA-w5g8-5849-vj76
web, mitigation, vendor-advisory, advisory
-
github.com
/zauberzeug/nicegui/releases/tag/v3.9.0
web, product, release-notes, advisory
-
nvd.nist.gov
/vuln/detail/CVE-2026-33332
advisory
-
github.com
/zauberzeug/nicegui
package
Sources
- CVE List CVE-2026-33332
- GitHub Advisory GHSA-w5g8-5849-vj76
- NVD CVE-2026-33332
- OSV PYSEC-2026-2233
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.