← Vulnerability feed

Vulnerability record · CVE-2026-21874 · published 8 January 2026

CVE-2026-21874: Zauberzeug nicegui vulnerability

Zauberzeug · Nicegui

NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality. This issue has been patched in version 3.5.0.

5.3 CVSS 3.1 Medium EPSS 0.56% · top 55.2% CWE-772 · CWE-772
5.3CVSS 3.1 base score
0.56%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality. This issue has been patched in version 3.5.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83 Patch
https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0 Release Notes
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2 ExploitVendor Advisory
https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2 ExploitVendor Advisory

Track CVE-2026-21874 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2026-39844Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Prior to 3.10.0, Since PurePosixPath only recognizes forward slashes (/) as path separators, an attacker can …EPSS 0.49%7.5CVE-2026-25732Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Prior to 3.7.0, NiceGUI's FileUpload.name property exposes client-supplied filename metadata without sanitiza…EPSS 3.0%7.5CVE-2025-66645Zauberzeug nicegui path traversal vulnerabilityNiceGUI is a Python-based UI framework. Versions 3.3.1 and below are vulnerable to directory traversal through the App.add_media_files() function, wh…EPSS 1.1%6.9CVE-2026-33332Zauberzeug nicegui improper input validation vulnerabilityNiceGUI is a Python-based UI framework. Prior to version 3.9.0, NiceGUI's app.add_media_file() and app.add_media_files() media routes accept a user-c…EPSS 0.69%6.1CVE-2026-27156Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. Prior to version 3.8.0, several NiceGUI APIs that execute methods on client-side elements (`Element.run_metho…EPSS 0.27%6.1CVE-2026-25516Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. The ui.markdown() component uses the markdown2 library to convert markdown content to HTML, which is then ren…EPSS 0.29%6.1CVE-2026-21873Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. From versions 2.22.0 to 3.4.1, an unsafe implementation in the pushstate event listener used by ui.sub_pages …EPSS 0.26%6.1CVE-2026-21871Zauberzeug nicegui cross-site scripting vulnerabilityNiceGUI is a Python-based UI framework. From versions 2.13.0 to 3.4.1, there is a XSS risk in NiceGUI when developers pass attacker-controlled string…EPSS 0.28%

Source: NIST National Vulnerability Database (record CVE-2026-21874), CISA KEV, FIRST EPSS (scores of 2026-10-02). This page is refreshed as NVD updates the record.