Listen to this Post
The vulnerability occurs in the client disconnect sequence. When a browser tab disconnects, the `handle_disconnect()` method clears the client’s `tab_id` attribute (line 307 in client.py). Subsequently, the `delete()` method (line 319) is called, which relies on the `tab_id` to locate and clean up the corresponding `RedisPersistentDict` object for that specific tab. Because `tab_id` is already `None` at this point, the cleanup path in `RedisPersistentDict` (line 92 in redis_persistent_dict.py) is never invoked. This prevents the proper closure of the dedicated Redis client connection and its pubsub subscription created for each tab. An attacker can repeatedly open and close tabs, causing these orphaned connections to accumulate permanently. Eventually, Redis reaches its configured `maxclients` limit, rejecting new connections and causing a denial-of-service for storage functionality while the main NiceGUI app remains online.
Platform: NiceGUI
Version: Not specified
Vulnerability: Connection Leak
Severity: Critical
date: 2026-01-01
Prediction: 2026-01-15
What Undercode Say:
redis-cli CONFIG SET maxclients 50 NICEGUI_REDIS_URL=redis://localhost:6379/0 python test_connection_leak.py python attack_connection_leak.py
From test_connection_leak.py
def _patched_handle_disconnect(self, socket_id: str) -> None:
tab_id_before = self.tab_id
_original_handle_disconnect(self, socket_id)
log.warning("disconnect: tab_id=%s cleared, tabs=%d", tab_id_before, len(app.storage._tabs))
How Exploit:
Unauthenticated attacker opens/closes browser tabs repeatedly against a NiceGUI app using Redis storage, exhausting Redis connection pool.
Protection from this CVE
Fix client.py disconnect sequence. Ensure `tab_id` remains available for cleanup in `delete()` method before clearing.
Impact:
Redis DoS, broken storage functionality, data loss for new users/tabs.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
