CVE-2026-33332: 
Python vulnerability analysis and mitigation

CVE-2026-33332 is a memory exhaustion vulnerability in NiceGUI, a Python-based UI framework, caused by an unvalidated chunk size query parameter in media streaming routes. Specifically, app.add_media_file() and app.add_media_files() accept a user-controlled query parameter that is passed to the range-response implementation without validation, allowing attackers to bypass chunked streaming and force the server to load entire files into memory. All NiceGUI versions up to and including 3.8.0 are affected; version 3.9.0 contains the fix. The vulnerability carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory).

The root cause is classified as CWE-20 (Improper Input Validation) and CWE-770 (Allocation of Resources Without Limits or Throttling). NiceGUI's media route handler accepts a query parameter that controls how file data is read during HTTP range-based streaming; because this parameter is forwarded to the range-response implementation without any bounds checking or sanitization, an attacker can supply a crafted value that causes the server to read and buffer an entire large media file into memory rather than streaming it in chunks. No authentication or special privileges are required — exploitation requires only a crafted HTTP request with a malicious query parameter, making the attack complexity low (GitHub Advisory).

Successful exploitation results in excessive server-side memory consumption, which can cause performance degradation, memory pressure, and potential out-of-memory (OOM) conditions leading to denial of service. The impact is limited to availability — there is no confidentiality or integrity impact, and the vulnerability does not enable code execution or data exfiltration. The risk is amplified when an attacker sends concurrent requests targeting large video or audio files, as each request forces a full file load into memory, rapidly exhausting available resources (GitHub Advisory).

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation at this time (Feedly). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.025% (0.000250), indicating a low probability of exploitation in the near term. Despite the low EPSS, the attack complexity is low and no authentication is required, meaning any unauthenticated network attacker can attempt exploitation against exposed NiceGUI instances serving media content.

1. Reconnaissance: Identify internet-facing NiceGUI applications (versions ≤ 3.8.0) that serve media content via app.add_media_file() or app.add_media_files(), using tools like Shodan or Censys to find Python/NiceGUI web services.
2. Identify media endpoints: Browse or probe the target application to locate media streaming endpoints (e.g., URLs serving video or audio files registered via NiceGUI's media route APIs).
3. Craft malicious request: Construct an HTTP GET request to a media endpoint with a crafted query parameter that overrides the chunk size or streaming behavior, instructing the server to load the entire file into memory instead of streaming it in chunks.
4. Amplify with concurrent requests: Send multiple simultaneous requests to the same or different large media files to multiply memory consumption and accelerate resource exhaustion.
5. Achieve denial of service: The server's available memory is exhausted, causing OOM conditions, process crashes, or severe performance degradation that renders the application unavailable (GitHub Advisory).

• Network: High volume of concurrent HTTP GET requests to NiceGUI media endpoints (paths registered via add_media_file/add_media_files) from one or few source IPs; requests containing unusual or oversized query parameters on media routes.
• Logs: Web server or application logs showing repeated requests to media streaming endpoints with unexpected query parameters; abnormally high response times or connection timeouts on media routes.
• Process/System: Rapid increase in Python process memory consumption (RSS) correlated with media endpoint requests; OOM killer events in system logs (dmesg or /var/log/syslog) referencing the NiceGUI process; system swap usage spikes during request bursts.

Upgrade NiceGUI to version 3.9.0 or later, which validates the chunk size query parameter before passing it to the range-response implementation (GitHub Advisory, Patch Commit). As a temporary workaround for organizations unable to upgrade immediately, restrict access to media endpoints using authentication or IP allowlisting, or configure a reverse proxy (e.g., nginx) to strip or reject unexpected query parameters on media routes. Rate-limiting concurrent connections to media endpoints at the network or proxy layer can also reduce the risk of memory exhaustion.