Executive brief
NiceGUI is a Python framework used for building web-based user interfaces. A vulnerability in how the framework handles requests for certain internal files allows unauthenticated remote attackers to trigger server errors repeatedly. This can lead to a denial-of-service condition by rapidly filling up server storage with error logs or overwhelming log-monitoring systems, potentially masking other security events or crashing the server due to lack of disk space.
Technical details
A denial-of-service vulnerability exists in NiceGUI's dynamic resource and ESM module routes. These routes accept a sub-path parameter and use `pathlib.Path.exists()` to validate the request; however, this check returns true for directories. When a directory path is passed to Starlette's `FileResponse`, it raises an unhandled `RuntimeError`. Because Uvicorn logs the full traceback for unhandled exceptions, an unauthenticated remote attacker can send crafted requests to amplify log volume. This can result in disk space exhaustion or the saturation of log-processing pipelines. The issue is fixed in version 3.12.0 by ensuring requested paths resolve to files rather than directories.
Affected products
- zauberzeug NiceGUI <= 3.11.1
Timeline
- 2026-05-12: patched: Version 3.12.0 released
- 2026-05-12: advisory: GitHub Security Advisory published
- 2026-06-02: disclosed: CVE published to NVD