CVE-2026-33332 Details

A memory exhaustion vulnerability has been identified in NiceGUI versions prior to 3.9.0. The issue arises in the 'app.add_media_file()' and 'app.add_media_files()' media routes, where a user-controlled query parameter is accepted without proper validation. This parameter influences how files are read during streaming, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. When large media files are involved, especially with concurrent requests, this can lead to excessive memory consumption, degraded performance, or a denial-of-service condition.

Users are advised to upgrade to NiceGUI version 3.9.0 or later, where this vulnerability has been patched. As an additional measure, access to media endpoints can be restricted or unexpected query parameters stripped at the reverse proxy layer.