CVE-2026-34824
Received Received - Intake
Uncontrolled Thread Exhaustion DoS in Mesop WebSocket Component

Publication date: 2026-04-03

Last updated on: 2026-04-13

Assigner: GitHub, Inc.

Description
Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-04-03
Last Modified
2026-04-13
Generated
2026-06-16
AI Q&A
2026-04-04
EPSS Evaluated
2026-06-15
NVD
CVE-2026-34824
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
mesop-dev mesop From 1.2.3 (inc) to 1.2.5 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
CWE-125 The product reads data past the end, or before the beginning, of the intended buffer.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Mesop Python-based UI framework, specifically in its WebSocket implementation between versions 1.2.3 and before 1.2.5. An unauthenticated attacker can exploit this by sending a rapid succession of WebSocket messages, which causes the server to spawn an unlimited number of operating system threads.

The uncontrolled creation of threads leads to thread exhaustion and Out of Memory (OOM) errors, ultimately causing a complete Denial of Service (DoS) for any application built on the Mesop framework.

This issue was fixed in version 1.2.5 of the Mesop framework.

Impact Analysis

If your application uses the Mesop framework versions between 1.2.3 and before 1.2.5, this vulnerability can be exploited by an unauthenticated attacker to cause a Denial of Service (DoS).

The attacker can overwhelm the server by forcing it to spawn an unbounded number of threads, leading to resource exhaustion and Out of Memory errors.

As a result, your application may become completely unavailable to legitimate users until the server is restarted or the issue is mitigated.

Mitigation Strategies

To mitigate this vulnerability, you should upgrade the Mesop framework to version 1.2.5 or later, where the issue has been patched.

Until the upgrade can be applied, consider limiting the rate of incoming WebSocket messages or implementing resource usage limits to prevent thread exhaustion and Out of Memory errors.

Compliance Impact

The vulnerability in the Mesop framework causes a Denial of Service (DoS) by exhausting system resources through uncontrolled thread creation. While this impacts availability, there is no indication from the provided information that it affects confidentiality or integrity of data.

Since common standards and regulations like GDPR and HIPAA emphasize the protection of personal data confidentiality, integrity, and availability, this vulnerability primarily impacts the availability aspect. Organizations relying on Mesop-based applications could face service outages, which may affect compliance with availability requirements under these regulations.

However, there is no direct information linking this vulnerability to data breaches or unauthorized data access, so its impact on compliance is limited to potential service disruption.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-34824. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart