CVE-2026-45554

NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes

Published Jun 2, 2026 CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Description

NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.

Analysis

Technical impact

NiceGUI, a Python UI framework, has a flaw where two FastAPI routes that serve per-component static assets accept a sub-path that can refer to a directory. When such a request is made, an unhandled RuntimeError occurs inside Starlette’s FileResponse, causing Uvicorn to log a full exception traceback. This represents an unexpected error that can be triggered without authentication and can be used to amplify log output.

Affected Systems

All installations of NiceGUI version 3.11 and earlier, produced by zauberzeug, are affected. The patch that fixes the issue is included in release 3.12.0.

Risk and Exploitability

The vulnerability has a CVSS score of 5.3, indicating moderate risk. There is no EPSS score available and the issue is not listed in the CISA KEV catalog. A remote attacker can reach the vulnerable routes without authentication and send a large number of requests that generate massive log traces, potentially saturating disk or log‑pipeline resources. No additional prerequisites are required beyond network reachability to the NiceGUI server.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

zauberzeug

nicegui

affected

Version	Status	Constraints
`< 3.12.0`	affected	—

No data.

Vendor Product Versions

Zauberzeug

Nicegui

Version	Status	Scheme	Platform
`[0,3.12.0)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade NiceGUI to version 3.12.0 or later.
Restrict network access to the NiceGUI static asset routes if an upgrade cannot be performed immediately.
Configure log rotation and enforce disk space limits to mitigate the impact of potential log flooding.

Generated by OpenCVE AI on June 2, 2026 at 16:50 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-pq7c-x8g4-rvp6	NiceGUI: Unauthenticated log-volume denial of service in dynamic resource routes

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.343% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-pq7c-x8g4-rvp6

History

Jun 2, 2026 6:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jun 2, 2026 4:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Zauberzeug Zauberzeug nicegui
Vendors & Products		Zauberzeug Zauberzeug nicegui

Jun 2, 2026 3:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		NiceGUI is a Python-based UI framework. Prior to version 3.12.0, two FastAPI routes that serve per-component static assets in NiceGUI accept a sub-path parameter that may resolve to a directory rather than a file. Requests that resolve to a directory raise an unhandled RuntimeError inside Starlette's FileResponse, which Uvicorn writes to the server log as a full traceback. Because the routes are reachable without authentication, a remote attacker can amplify log volume and consume disk and log-pipeline capacity on any publicly reachable NiceGUI server. This issue has been patched in version 3.12.0.
Title		NiceGUI: Unauthenticated log-flood DoS via trailing slash on ESM and per-component resource routes
Weaknesses		CWE-248 CWE-770
References		https://github.com/zauberzeug/nicegui/releases/tag/v3.12.0 https://github.com/zauberzeug/nicegui/security/advisories/GHSA-pq7c-x8g4-rvp6
Metrics		cvssV3_1 `{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}`