CVE-2026-34824
HighCVSS 7.5Exploitation Probability (EPSS)
Elevated risk50th percentile - higher than 50% of all known CVEs
Summary
Mesop, a Python-based UI framework, from version 1.2.3 to before version 1.2.5 contains an uncontrolled resource consumption vulnerability in the WebSocket implementation. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of OS threads, leading to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS).
Risk Assessment
An attacker can remotely crash any application built on the Mesop framework, leading to service disruption and potential data loss.
Recommendation
Upgrade Mesop to version 1.2.5 or later, which includes a fix that limits resource consumption.
Other vulnerabilities in Mesop
See all- CVE-2026-93421Medium
Mesop is a Python-based UI framework for building web applications. Prior to 1.3.4, the unauthenticated /__csp__ endpoint passes attacker-controlled document-uri, blocked-uri, and violated-directive values to the csp_report handler in mesop/server/static_file_serving.py, which prints them to standard output without neutralizing terminal control sequences. When an operator views the resulting logs in an ANSI-capable terminal, injected ANSI or VT100 sequences can clear or reposition the display, hide text, or present forged messages, reducing the integrity of monitoring and incident-response output. This issue is fixed in version 1.3.4.
- CVE-2026-77357High
Mesop prior to version 1.3.3, when running in debug mode, exposes a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter. An unauthenticated attacker can send requests with high counter values, exhausting the worker pool and making the server unavailable. The attack requires minimal effort and leaves the server unresponsive until manually restarted.
Original NVD description (English source)
Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS