CVE-2026-34824 Details
Description
Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.
A denial-of-service vulnerability has been identified in the Mesop framework, specifically in versions 1.2.3 prior to 1.2.5. The issue arises from an uncontrolled resource consumption flaw in the WebSocket implementation. An unauthenticated attacker can send a rapid succession of messages, causing the server to spawn an unbounded number of operating system threads. This behavior leads to thread exhaustion and out-of-memory errors, causing any application built on the framework to become unresponsive. The vulnerability has been patched in version 1.2.5.
Users can upgrade to Mesop version 1.2.5 or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Apr 6, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679 | CISA-ADP | ExploitMitigationVendor Advisory |
| https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987 | [email protected] | Patch |
| https://github.com/mesop-dev/mesop/releases/tag/v1.2.5 | [email protected] | ProductRelease Notes |
| https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679 | [email protected] | ExploitMitigationVendor Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
| CWE-125 | Out-of-bounds Read | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| mesop-dev mesop | >= 1.2.3, < 1.2.5 |
CPE
Remediation
| |
Change History
6 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 24, 2026 | CVE Translated | [email protected] |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 13, 2026 | Initial Analysis | [email protected] |
| Apr 6, 2026 | CVE Modified | CISA-ADP |
| Apr 3, 2026 | New CVE Received | [email protected] |