Mesop, a Python‑based UI framework, allowed an unauthenticated attacker to trigger a denial of service by sending a GET request to the /hot‑reload endpoint while the application ran in debug mode. The endpoint parsed a user‑supplied counter parameter that drove an unbounded loop, consuming worker threads until the worker pool was exhausted and the server became unresponsive. A single attacker could crash the server with minimal effort, and the server remained unavailable until manually restarted.

The vulnerability affects the Mesop framework from the mesop‑dev vendor, specifically any deployment using a version earlier than 1.3.3 that is running in debug mode. Version 1.3.3 and later contain the fix.

With a CVSS score of 8.7, this is a high severity vulnerability. The attack vector is inferred to be an external HTTP GET to /hot‑reload, requiring no authentication. Because exploitation simply exhausts worker threads, the EPSS score is not available, and the vulnerability is not listed in CISA KEV. An attacker can achieve a full service outage, affecting availability for all users of the impacted server.