CVE-2026-21874: NiceGUI Redis Connection DOS Vulnerability

CVE-2026-21874 Overview

CVE-2026-21874 is a resource exhaustion vulnerability affecting NiceGUI, a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. The vulnerability occurs because connections are never properly released, leading to service degradation when Redis hits its connection limit. While NiceGUI continues accepting new connections and the application stays up, errors are logged and storage functionality becomes broken.

Critical Impact

Unauthenticated attackers can cause denial of service by exhausting Redis connection pools, degrading application storage functionality without taking down the service entirely.

Affected Products

• NiceGUI versions v2.10.0 through 3.4.1
• Applications using Redis-backed storage with NiceGUI
• Python web applications built on affected NiceGUI versions

Discovery Timeline

• 2026-01-08 - CVE CVE-2026-21874 published to NVD
• 2026-01-08 - Last updated in NVD database

Technical Details for CVE-2026-21874

Vulnerability Analysis

This vulnerability is classified as CWE-772 (Missing Release of Resource after Effective Lifetime). The core issue lies in how NiceGUI manages Redis connections during client session lifecycle events. When users open browser tabs connecting to a NiceGUI application with Redis-backed storage, connections to Redis are established to handle persistent data. However, when those browser tabs are closed, the corresponding Redis connections are not properly released back to the connection pool.

An unauthenticated attacker can exploit this behavior by programmatically or manually opening and closing multiple browser tabs in rapid succession. Each tab opening establishes a new Redis connection, and each tab closing fails to release it. Over time, this exhausts the available Redis connections, causing the connection pool to hit its configured maximum limit.

Root Cause

The root cause is improper resource management in the client disconnect handling logic. When a client disconnects (browser tab closes), the tab_id tracking mechanism was not properly coordinating with the Redis connection cleanup. The patch reveals that the fix involved capturing the tab_id_to_close before clearing the tab_id reference, ensuring proper resource cleanup can occur. Additionally, the Redis persistent dictionary implementation was updated to include proper asyncio handling and context management for connection lifecycle.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker simply needs to:

1. Identify a NiceGUI application using Redis-backed storage
2. Repeatedly open connections to the application (browser tabs or automated HTTP connections)
3. Close those connections without allowing proper cleanup
4. Continue until Redis connection limit is reached

The attack does not crash the application outright—instead, it degrades storage functionality while the application continues to accept requests, potentially causing data inconsistencies and user session issues.

# Security patch in nicegui/client.py
# Source: https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83
         document_id = self._socket_to_document_id.pop(socket_id)
         self._cancel_delete_task(document_id)
         self._num_connections[document_id] -= 1
+        tab_id_to_close = self.tab_id
         self.tab_id = None

         for t in self.disconnect_handlers:

The patch captures the tab_id before clearing it, allowing proper resource cleanup to be performed with the correct reference.

Detection Methods for CVE-2026-21874

Indicators of Compromise

• Rapid increase in Redis connection count without corresponding increase in legitimate user sessions
• Redis log entries indicating maximum connection limits being reached
• NiceGUI application logs showing storage-related errors while the application remains responsive
• Unusual patterns of WebSocket connections opening and closing rapidly from single or few IP addresses

Detection Strategies

• Monitor Redis connection pool metrics using INFO clients command for abnormal connection growth
• Implement rate limiting on new WebSocket connections per IP address
• Set up alerts for Redis maxclients threshold warnings
• Review NiceGUI application logs for repeated storage initialization failures

Monitoring Recommendations

• Configure Redis monitoring tools (Redis Sentinel, Prometheus with Redis exporter) to track active connections
• Implement application-level logging for client connect/disconnect events with correlation IDs
• Set up automated alerts when Redis connections exceed 80% of maxclients configuration
• Monitor for patterns of rapid session creation and termination from individual IP addresses

How to Mitigate CVE-2026-21874

Immediate Actions Required

• Upgrade NiceGUI to version 3.5.0 or later immediately
• Review and adjust Redis maxclients configuration based on expected legitimate traffic
• Implement connection rate limiting at the network or application layer
• Monitor Redis connection metrics for signs of exploitation attempts

Patch Information

The vulnerability has been patched in NiceGUI version 3.5.0. The fix addresses the resource leak by properly tracking and releasing Redis connections during client disconnect events. The patch is available in commit 6c52eb2c90c4b67387c025b29646b4bc1578eb83.

For detailed information, refer to:

• GitHub Security Advisory GHSA-mp55-g7pj-rvm2
• NiceGUI v3.5.0 Release

Workarounds

• Configure Redis maxclients to a higher value to increase headroom while awaiting patch deployment
• Implement a reverse proxy with connection rate limiting to slow potential attacks
• Use Redis connection pooling with aggressive timeout settings to reclaim stale connections
• Consider switching to alternative storage backends temporarily if Redis storage is not critical

# Configuration example - Redis connection limit adjustment
# In redis.conf, increase maxclients (temporary mitigation)
maxclients 20000

# Set timeout to automatically close idle connections
timeout 300

# Enable connection monitoring
tcp-keepalive 60