An unauthenticated attacker can send a rapid succession of WebSocket messages to the Mesop framework, causing the server to spawn an unbounded number of operating system threads. This uncontrolled resource consumption leads to thread exhaustion and out‑of‑memory errors, resulting in a complete denial of service for any application built on the framework. The weakness is consistent with CWE‑125 and CWE‑770.

The vulnerability affects the Mesop framework, released under the mesop‑dev:mesop product name. Versions from 1.2.3 up to, but not including, 1.2.5 are vulnerable. Applications built with these versions and deployed on any Python runtime are at risk until the issue is patched to 1.2.5 or later.

This issue carries a CVSS score of 7.5, which represents a high impact. The EPSS score is reported as less than 1 %, indicating a low current likelihood of exploitation. It is not listed in the CISA KEV catalog. The vulnerability can be exploited by an unauthenticated attacker over the network by transmitting a rapid stream of WebSocket messages, requiring no prior access or privileged credentials.