CVE-2026-21874: fallo de gravedad media en zauberzeug nicegui
NiceGUI has Redis connection leak via tab storage causes service degradation
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.3epss 0.6%
NiceGUI is a Python-based UI framework. From versions v2.10.0 to 3.4.1, an unauthenticated attacker can exhaust Redis connections by repeatedly opening and closing browser tabs on any NiceGUI application using Redis-backed storage. Connections are never released, leading to service degradation when Redis hits its connection limit. NiceGUI continues accepting new connections - errors are logged but the app stays up with broken storage functionality. This issue has been patched in version 3.5.0.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Productos afectados
zauberzeug · niceguiCVEs relacionadas — zauberzeug nicegui
En el mismo producto, de las más peligrosas a las menos.
CVE-2026-25732HIGHNiceGUI's Path Traversal via Unsanitized FileUpload.name Enables Arbitrary File WriteEPSS 3.4%CVE-2025-66645HIGHNiceGUI Path Traversal Vulnerability in app.add_media_files() Allows Arbitrary File ReadingEPSS 1.2%CVE-2024-32005HIGHLocal File Inclusion in NiceGUI leaflet componentEPSS 0.8%CVE-2026-33332MEDIUMNiceGUI's unvalidated chunk size parameter in media routes can cause memory exhaustionEPSS 0.6%CVE-2025-21618HIGHNiceGUI On Air authentication issueEPSS 0.4%CVE-2026-39844MEDIUMNiceGUI has a Path Traversal in NiceGUI Upload Filename on Windows via Backslash Bypass of PurePosixPath SanitizationEPSS 0.4%