NiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustion

NiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-controlled query parameter that influences how files are read during streaming. The parameter is passed to the range-response implementation without validation, allowing an attacker to bypass chunked streaming and force the server to load entire files into memory at once. With large media files and concurrent requests, this can lead to excessive memory consumption, degraded performance, or denial of service. This issue has been patched in version 3.9.0.

N/A

输入验证不恰当

NiceGUI 安全漏洞

NiceGUI是NiceGUI开源的一个易于使用、基于 Python 的 UI 框架。 NiceGUI 3.9.0之前版本存在安全漏洞，该漏洞源于app.add_media_file()和app.add_media_files()媒体路由接受未经验证的用户控制查询参数，可能导致攻击者绕过分块流式传输并强制服务器将整个文件加载到内存，进而导致内存消耗过度、性能下降或拒绝服务。

N/A

N/A