PT-2026-2113 · Redis+1 · Redis+1

Yudelevi · Published 2026-01-08 · Updated 2026-01-08 · CVE-2026-21874

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions NiceGUI versions 2.10.0 through 3.4.1

Description NiceGUI is a Python-based UI framework. An unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are not released, leading to service degradation when Redis reaches its connection limit. NiceGUI continues accepting new connections, but errors are logged and storage functionality is broken.

Recommendations Upgrade to version 3.5.0 or later.

Exploit

Fix

Missing Release of Resource after Effective Lifetime

Weakness Enumeration

CWE-772

Related Identifiers

CVE-2026-21874

GHSA-MP55-G7PJ-RVM2

Affected Products

Nicegui

Redis

References · 10

• 🔥 https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2 · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/21xxx/CVE-2026-21874.json · Exploit
• https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83 · Patch
• https://osv.dev/vulnerability/CVE-2026-21874 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-21874 · Security Note
• https://osv.dev/vulnerability/GHSA-mp55-g7pj-rvm2 · Vendor Advisory
• https://github.com/zauberzeug/nicegui · Note
• https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0 · Note
• https://t.me/CVEtracker/41710 · Telegram Post
• https://twitter.com/CVEnew/status/2009208592948432899 · Twitter Post