CVE-2026-21874

NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality. This issue has been patched in version 3.5.0.

• CWE-772

• https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83Patch
• https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0Release Notes
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2Exploit, Vendor Advisory
• https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2Exploit, Vendor Advisory

Published

Jan 8, 2026

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-21869llama.cpp is an inference of several LLM models in C/C++. In…9.8
• CVE-2026-2187A vulnerability was found in Tenda RX3 16.03.13.11. The affe…8.8
• CVE-2026-21870BACnet Protocol Stack library provides a BACnet application …5.5
• CVE-2026-21871NiceGUI is a Python-based UI framework. From versions 2.13.0…6.1
• CVE-2026-21872NiceGUI is a Python-based UI framework. From versions 2.22.0…6.1
• CVE-2026-21873NiceGUI is a Python-based UI framework. From versions 2.22.0…6.1
• CVE-2026-21875ClipBucket v5 is an open source video sharing platform. Vers…9.8
• CVE-2026-21876The OWASP core rule set (CRS) is a set of generic attack det…5.3
• CVE-2026-21877n8n is an open source workflow automation platform. In versi…9.9
• CVE-2026-21878BACnet Stack is a BACnet open source protocol stack C librar…7.5
• CVE-2026-21879Kanboard is project management software focused on Kanban me…6.1
• CVE-2026-2188A vulnerability was determined in UTT 进取 521G 3.1.1-190816. …7.3