CVE-2026-45554 Details
Description
NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.
A denial-of-service vulnerability has been identified in NiceGUI, a Python-based UI framework, prior to version 3.12.0. The issue arises in two FastAPI routes that serve per-component static assets. These routes accept a sub-path parameter that can be manipulated to resolve to a directory instead of a file. When a request targets a directory, it triggers an unhandled RuntimeError in Starlette's FileResponse. This error is logged by Uvicorn as a full traceback, amplifying log volume and consuming disk space. The vulnerability is accessible without authentication, allowing remote attackers to disrupt any publicly reachable NiceGUI server by overloading its log capacity and exhausting disk space.
Users can upgrade to NiceGUI version 3.12.0 or later, where this vulnerability has been patched. For those unable to upgrade immediately, it is recommended to place NiceGUI behind a reverse proxy that rejects requests targeting directories in the vulnerable FastAPI routes, or to rate-limit the NiceGUI prefix at the proxy.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 2, 2026CISA-ADP
Assessed Jun 2, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0 | [email protected] | Release NotesVendor |
| https://github.com/zauberzeug/nicegui/security/advisories/GHSA-pq7c-x8g4-rvp6 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-248 | Uncaught Exception | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| NiceGUI | <= 3.11.1 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 22, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 2, 2026 | New CVE Received | [email protected] |