Denial of Service in NiceGUI Affected by Redis Connection Exhaustion

CVE-2026-21874

What is CVE-2026-21874?

NiceGUI, a Python-based UI framework, is susceptible to a vulnerability that allows unauthenticated attackers to exhaust Redis connections by rapidly opening and closing browser tabs within applications that utilize Redis-backed storage. This continuous connection opening leads to the exhaustion of available Redis connections, causing service degradation when the connection limit is reached. Although errors are logged, NiceGUI remains operational, albeit with compromised storage functionality. The issue has been resolved in version 3.5.0.

References