CVE-2026-34824 | THREATINT

Description

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.

PUBLISHED Reserved 2026-03-30 | Published 2026-04-03 | Updated 2026-04-06 | Assigner GitHub_M

HIGH: 7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Problem types

CWE-125: Out-of-bounds Read

Product status

>= 1.2.3, < 1.2.5

affected

References

github.com/.../mesop/security/advisories/GHSA-3jr7-6hqp-x679 exploit

github.com/.../mesop/security/advisories/GHSA-3jr7-6hqp-x679

github.com/...ommit/760a2079b5c609038c826d24dfbcf9b0be98d987

github.com/mesop-dev/mesop/releases/tag/v1.2.5

cve.org (CVE-2026-34824)

nvd.nist.gov (CVE-2026-34824)

Download JSON