NiceGUI is a Python‑based UI framework that supports Redis‑backed storage. From versions 2.10.0 to 3.4.1, an unauthenticated attacker can cause a Redis connection leak—a CWE‑772: Unreleased Resource flaw—by repeatedly opening and closing browser tabs on any NiceGUI application that uses Redis. The framework does not release connections, eventually exhausting the Redis pool. When the limit is reached, the application continues to accept new connections, logs errors, and the storage layer becomes non‑functional, resulting in degraded service quality or intermittent failures.

The affected product is NiceGUI from the maker Zauberzeug. All releases between version 2.10.0 and 3.4.1 are vulnerable. Version 3.5.0 and later include the fix.

The vulnerability has a CVSS score of 5.3, indicating moderate severity. The EPSS score of less than 1 % signals a very low probability of exploitation in the wild. It is not listed in the CISA KEV catalog. The likely attack vector is any end‑user interacting with a vulnerable NiceGUI application – no authentication is required, and the attacker can trigger the leak simply by opening many tabs. Because the exposure is unprivileged and tied to client‑side navigation, a large‑scale impact would require an attacker to engineer a situation where many users or a single user open a vast number of tabs. Successful exploitation would consume all Redis connections, causing the application to log errors and degrade its storage functionality, potentially impacting availability.