Vulnerability Report

CVE-2026-34824

Title: Uncontrolled resource consumption (DoS) in Mesop WebSocket

DoS

Proof Of Concept

No public PoC currently indexed for CVE-2026-34824.

CWE Category CWE-125

Published Date Apr 03, 2026

Modified Date Jul 24, 2026

Exploit Status Not Found

Score 7.5 CVSS v3.1

Exploit Probability (EPSS)

0.67%

Vulnerability Summary

CVE-2026-34824: Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.

Impacted Vendors

mesop-dev 1

Reference Links

https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987 https://github.com/mesop-dev/mesop/releases/tag/v1.2.5 https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679

CVSS v3.1

Source Entity [email protected]

Severity HIGH

7.5

Attack Vector

NETWORK

Complexity

LOW

Privileges

N/A

Interaction

NONE

Confidentiality

N/A

Integrity

N/A

Availability

N/A

Scope

UNCHANGED

RAW VECTOR CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Associated Attack Patterns (CAPEC)

Total: Patterns