Improper Input Validation in NiceGUI Media Handling by Zauberzeug

CVE-2026-33332

What is CVE-2026-33332?

NiceGUI, a Python-based UI framework, suffers from an improper input validation vulnerability in its media routes, specifically in the app.add_media_file() and app.add_media_files() methods. This issue arises as a user-controlled query parameter influences how files are handled during streaming, allowing attackers to bypass the chunked streaming mechanism. Consequently, this can lead to the server loading entire media files into memory, especially under heavy load with large files and multiple concurrent requests. This flaw can cause significant memory consumption and performance degradation, potentially leading to a denial of service. The issue has been addressed in version 3.9.0, which includes important fixes to enhance the media file handling process.

References