Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-grbn-3vxr-rqds
Vulnerability ID VCID-grbn-3vxr-rqds
Aliases CVE-2026-21874
GHSA-mp55-g7pj-rvm2
Summary NiceGUI has Redis connection leak via tab storage causes service degradation An unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. **NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality.**
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-772 Missing Release of Resource after Effective Lifetime
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00029 https://api.first.org/data/v1/epss?cve=CVE-2026-21874
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-mp55-g7pj-rvm2
cvssv3.1 5.3 https://github.com/zauberzeug/nicegui
generic_textual MODERATE https://github.com/zauberzeug/nicegui
cvssv3.1 5.3 https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83
generic_textual MODERATE https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83
ssvc Track https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83
cvssv3.1 5.3 https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0
generic_textual MODERATE https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0
ssvc Track https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0
cvssv3.1 5.3 https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2
cvssv3.1_qr MODERATE https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2
generic_textual MODERATE https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2
ssvc Track https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2026-21874
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2026-21874
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2026-21874
https://github.com/zauberzeug/nicegui
https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83
https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0
CVE-2026-21874 https://nvd.nist.gov/vuln/detail/CVE-2026-21874
GHSA-mp55-g7pj-rvm2 https://github.com/advisories/GHSA-mp55-g7pj-rvm2
GHSA-mp55-g7pj-rvm2 https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/zauberzeug/nicegui
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:43:46Z/ Found at https://github.com/zauberzeug/nicegui/commit/6c52eb2c90c4b67387c025b29646b4bc1578eb83
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:43:46Z/ Found at https://github.com/zauberzeug/nicegui/releases/tag/v3.5.0
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:Y/T:P/P:M/B:A/M:M/D:T/2026-01-08T14:43:46Z/ Found at https://github.com/zauberzeug/nicegui/security/advisories/GHSA-mp55-g7pj-rvm2
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2026-21874
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.09019
EPSS Score 0.00029
Published At May 30, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-05-30T21:05:48.707075+00:00 GitLab Importer Import https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/nicegui/CVE-2026-21874.yml 38.6.0