PT-2026-26484 · Nicegui · Nicegui

Aest3Ra + 1 · Published 2026-03-19 · Updated 2026-03-24 · CVE-2026-33332

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions NiceGUI versions prior to 3.9.0

Description NiceGUI’s app.add media file() and app.add media files() functions are susceptible to a flaw where a user-controlled query parameter, passed to the range-response implementation without validation, can bypass chunked streaming. This allows an attacker to force the server to load entire files into memory. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. The vulnerable functions are used for serving media content. The parameter is passed to the range-response implementation.

Recommendations Upgrade to NiceGUI version 3.9.0 or later. As a workaround, restrict access to media endpoints. As a workaround, strip unexpected query parameters at a reverse proxy layer.

Exploit

Fix

Allocation of Resources Without Limits

RCE

Weakness Enumeration

CWE-770

CWE-20

Related Identifiers

CVE-2026-33332

GHSA-W5G8-5849-VJ76

Affected Products

Nicegui

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/33xxx/CVE-2026-33332.json · Exploit
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-w5g8-5849-vj76 · Vendor Advisory
• https://github.com/zauberzeug/nicegui/commit/9026962b8c4f3f225c98b2fbc35aa6b60cb3495b · Patch
• https://osv.dev/vulnerability/GHSA-w5g8-5849-vj76 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-33332 · Security Note
• https://osv.dev/vulnerability/CVE-2026-33332 · Vendor Advisory
• https://github.com/zauberzeug/nicegui · Note
• https://github.com/zauberzeug/nicegui/releases/tag/v3.9.0 · Note
• https://reddit.com/r/VulnMatter/comments/1ryvfc9/resumen_diario_de_vulnerabilidades_20032026 · Reddit Post