CVE-2026-77357

Received Received - Intake

Mesop Debug Mode Worker Exhaustion Vulnerability

Publication date: 2026-08-25

Last updated on: 2026-08-25

Assigner: GitHub, Inc.

Description

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads with high counter values until the worker pool is exhausted and the server becomes unavailable. A single unauthenticated attacker can crash the Mesop server with minimal effort. Because the attack leverages worker exhaustion, the server remains unresponsive until it is manually restarted. This issue is fixed in version 1.3.3.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-25

Last Modified

2026-08-25

Generated

2026-08-26

AI Q&A

2026-08-26

EPSS Evaluated

N/A

NVD

CVE-2026-77357

Affected Vendors & Products

Vendor	Product	Version / Range
mesop	mesop	to 1.3.3 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.
CWE-834	The product performs an iteration or loop without sufficiently limiting the number of times that the loop is executed.

Attack-Flow Graph

Executive Summary

Mesop is a Python UI framework. Before version 1.3.3, debug mode exposes a GET /hot-reload endpoint. This endpoint has an unbounded loop controlled by a user-supplied counter parameter. An unauthenticated attacker can send high counter values to exhaust worker threads, crashing the server until manually restarted.

Detection Guidance

To detect this vulnerability, monitor for excessive requests to the /hot-reload endpoint with high counter parameter values. Check server logs for repeated GET requests targeting this endpoint. Use network monitoring tools to identify unusual traffic patterns or worker thread exhaustion in Mesop applications running in debug mode prior to version 1.3.3.

Impact Analysis

An unauthenticated attacker can crash your Mesop server by sending a single request with a high counter value. This causes worker thread exhaustion, making the server unresponsive until restarted. The attack requires minimal effort and no authentication.

Mitigation Strategies

Immediately upgrade Mesop to version 1.3.3 or later to patch the vulnerability. If upgrading is not possible, disable debug mode in your Mesop application to prevent exposure of the /hot-reload endpoint. Restrict network access to the server if debug mode must remain enabled temporarily.

Hi! I’m here to help you understand CVE-2026-77357. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70