What’s Vulnerable › Vulnerabilities

CVE-2026-34824: Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2026-04-03 · updated 2026-07-24
• Weakness: CWE-125

Description

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.

Affected products

• mesop-dev mesop: from 1.2.3 before 1.2.5 — fixed in 1.2.5

How to fix

Upgrade to a fixed version: mesop-dev mesop 1.2.5. Check the vendor advisory for mitigations.

References

• https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987
• https://github.com/mesop-dev/mesop/releases/tag/v1.2.5
• https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679
• https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679

Get alerted when CVE-2026-34824 or the next vulnerability affects your stack