CVE-2026-34824

Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service

Published Apr 3, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.

Analysis

Technical impact

An unauthenticated attacker can send a rapid succession of WebSocket messages to the Mesop framework, causing the server to spawn an unbounded number of operating system threads. This uncontrolled resource consumption leads to thread exhaustion and out‑of‑memory errors, resulting in a complete denial of service for any application built on the framework. The weakness is consistent with CWE‑125 and CWE‑770.

Affected Systems

The vulnerability affects the Mesop framework, released under the mesop‑dev:mesop product name. Versions from 1.2.3 up to, but not including, 1.2.5 are vulnerable. Applications built with these versions and deployed on any Python runtime are at risk until the issue is patched to 1.2.5 or later.

Risk and Exploitability

This issue carries a CVSS score of 7.5, which represents a high impact. The EPSS score is reported as less than 1 %, indicating a low current likelihood of exploitation. It is not listed in the CISA KEV catalog. The vulnerability can be exploited by an unauthenticated attacker over the network by transmitting a rapid stream of WebSocket messages, requiring no prior access or privileged credentials.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

mesop-dev

mesop

affected

Version	Status	Constraints
`>= 1.2.3, < 1.2.5`	affected	—

Configuration 1 [-]

cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:python:*:*

No data.

Vendor Product Versions

Mesop-dev

Mesop

Version	Status	Scheme	Platform
`[1.2.3,1.2.5)`	affected	semver	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the Mesop 1.2.5 patch or later.
If patching is delayed, limit the rate of incoming WebSocket messages by implementing connection throttling.
Configure the server to cap the maximum number of concurrent threads or use a thread‑pool with a predefined upper bound.
Monitor thread usage and memory consumption for signs of exhaustion, and set alerts for sudden spikes.
Review and log WebSocket activity to detect anomalous patterns for future investigation.

Generated by OpenCVE AI on April 13, 2026 at 19:10 UTC.

Tracking

Advisories

Source	ID	Title
Github GHSA	GHSA-3jr7-6hqp-x679	Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.750% probability within 30 days)

Exploitation poc

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987
https://github.com/mesop-dev/mesop/releases/tag/v1.2.5
https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679

History

Apr 13, 2026 5:30 PM Weaknesses updated. Affected versions updated View changes

Type	Values Removed	Values Added
Weaknesses		CWE-770
CPEs		cpe:2.3:a:mesop-dev:mesop::::::python::*

Apr 7, 2026 12:00 AM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		Mesop-dev Mesop-dev mesop
Vendors & Products		Mesop-dev Mesop-dev mesop

Apr 6, 2026 4:45 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Apr 3, 2026 10:45 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.
Title		Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
Weaknesses		CWE-125
References		https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987 https://github.com/mesop-dev/mesop/releases/tag/v1.2.5 https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`