CVE-2026-21874 is a resource management vulnerability classified under CWE-772 (Missing Release of Resource after Effective Lifetime) affecting the NiceGUI Python-based UI framework. Specifically, versions from 2.10.0 up to 3.4.1 improperly manage Redis connections when Redis is used as the backend storage. An unauthenticated attacker can exploit this by repeatedly opening and closing browser tabs on any NiceGUI application that uses Redis-backed storage. Each tab opening initiates a Redis connection that is never released upon tab closure, causing a gradual exhaustion of available Redis connections. Once the Redis server hits its maximum connection limit, the service degrades: NiceGUI continues to accept new client connections, but storage operations fail and errors are logged. This leads to a denial-of-service-like condition affecting application availability, though confidentiality and integrity remain intact. The vulnerability requires no authentication or user interaction, making it relatively easy to exploit remotely. The issue was addressed and patched in NiceGUI version 3.5.0, which properly releases Redis connections after use. No known exploits are reported in the wild as of now.

For European organizations, this vulnerability primarily threatens the availability of applications built with NiceGUI that rely on Redis-backed storage. Service degradation or partial denial of service can disrupt business operations, especially for customer-facing or internal applications critical to workflows. Organizations using affected versions risk operational interruptions if attackers or even inadvertent user behavior triggers connection exhaustion. While confidentiality and data integrity are not directly impacted, the loss of storage functionality can lead to data loss or inconsistent application states. The impact is more pronounced for organizations with high traffic web applications or those that cannot quickly patch or restart Redis services. Additionally, sectors with stringent uptime requirements, such as finance, healthcare, and public services, may face compliance and reputational risks due to service unavailability.

European organizations should immediately upgrade NiceGUI to version 3.5.0 or later, where the vulnerability is patched. Until upgrading is possible, implement monitoring on Redis connection counts and set alerts for abnormal connection usage patterns. Configure Redis to limit maximum connections per client or implement connection pooling to mitigate exhaustion risks. Employ web application firewalls or rate limiting to restrict rapid tab opening/closing behaviors from single IP addresses. Consider isolating Redis instances used by NiceGUI applications to prevent broader impact on other services. Regularly audit application dependencies and maintain an inventory of NiceGUI versions in use. Finally, educate developers and administrators about proper resource management and encourage timely patching of third-party components.