CVE-2026-34824
Uncontrolled Thread Exhaustion DoS in Mesop WebSocket Component
Publication date: 2026-04-03
Last updated on: 2026-04-13
Assigner: GitHub, Inc.
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| mesop-dev | mesop | From 1.2.3 (inc) to 1.2.5 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-125 | The product reads data past the end, or before the beginning, of the intended buffer. |
| CWE-770 | The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability exists in the Mesop Python-based UI framework, specifically in its WebSocket implementation between versions 1.2.3 and before 1.2.5. An unauthenticated attacker can exploit this by sending a rapid succession of WebSocket messages, which causes the server to spawn an unlimited number of operating system threads.
The uncontrolled creation of threads leads to thread exhaustion and Out of Memory (OOM) errors, ultimately causing a complete Denial of Service (DoS) for any application built on the Mesop framework.
This issue was fixed in version 1.2.5 of the Mesop framework.
How can this vulnerability impact me? :
If your application uses the Mesop framework versions between 1.2.3 and before 1.2.5, this vulnerability can be exploited by an unauthenticated attacker to cause a Denial of Service (DoS).
The attacker can overwhelm the server by forcing it to spawn an unbounded number of threads, leading to resource exhaustion and Out of Memory errors.
As a result, your application may become completely unavailable to legitimate users until the server is restarted or the issue is mitigated.
What immediate steps should I take to mitigate this vulnerability?
To mitigate this vulnerability, you should upgrade the Mesop framework to version 1.2.5 or later, where the issue has been patched.
Until the upgrade can be applied, consider limiting the rate of incoming WebSocket messages or implementing resource usage limits to prevent thread exhaustion and Out of Memory errors.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in the Mesop framework causes a Denial of Service (DoS) by exhausting system resources through uncontrolled thread creation. While this impacts availability, there is no indication from the provided information that it affects confidentiality or integrity of data.
Since common standards and regulations like GDPR and HIPAA emphasize the protection of personal data confidentiality, integrity, and availability, this vulnerability primarily impacts the availability aspect. Organizations relying on Mesop-based applications could face service outages, which may affect compliance with availability requirements under these regulations.
However, there is no direct information linking this vulnerability to data breaches or unauthorized data access, so its impact on compliance is limited to potential service disruption.