CVE-2026-21874
Medium
Description
NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality. This issue has been patched in version 3.5.0.
SeverityMedium
CVSS5.3
Exploit probability—
ProductZauberzeug Nicegui
PublishedJan 8, 2026
First seenJan 8, 2026
Weakness typeCWE-772CWE-772
How to fix
Update
- zauberzeug nicegui3.5.0 or later
- nicegui3.5.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| zauberzeug nicegui | 2.10.0 ≤ v < 3.5.0 | 3.5.0 |
| niceguiPyPI | 2.10.0 ≤ v < 3.5.0 | 3.5.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.