Denial of Service in NiceGUI Affected by Redis Connection Exhaustion

CVE-2026-21874

What is CVE-2026-21874?

NiceGUI, a Python-based UI framework, is susceptible to a vulnerability that allows unauthenticated attackers to exhaust Redis connections by rapidly opening and closing browser tabs within applications that utilize Redis-backed storage. This continuous connection opening leads to the exhaustion of available Redis connections, causing service degradation when the connection limit is reached. Although errors are logged, NiceGUI remains operational, albeit with compromised storage functionality. The issue has been resolved in version 3.5.0.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References