NiceGUI is a Python‑based UI framework whose media routes allow a user‑controlled query parameter to influence file streaming. Prior to version 3.9.0 this parameter is forwarded to the range‑response logic without validation, enabling an attacker to bypass chunked streaming and force the server to load entire media files into memory. The resulting excessive memory usage can degrade performance or trigger a denial of service.

The vulnerability affects the zauberzeug NiceGUI framework. All releases older than 3.9.0 are impacted. The issue was fixed in the 3.9.0 release and is absent from subsequent versions.

The CVSS score of 6.9 indicates a moderate severity, while an EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. It can be exploited by sending HTTP requests to publicly exposed media routes with a crafted query parameter that forces the server to read full files into memory, which may exhaust RAM and disrupt service.