CVE-2026-34824

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-34824
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34824.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-34824
Aliases
Published
2026-04-03T22:41:34Z
Modified
2026-08-12T03:51:21Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
Details

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-125"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/34xxx/CVE-2026-34824.json"
}
References

Affected packages

Git / github.com/mesop-dev/mesop

Affected ranges

Type
GIT
Repo
https://github.com/mesop-dev/mesop
Events
Introduced
254727d4ad1eb912b74e4ce47c3321b5dd45d36d
Fixed
825184792eddaa7e1da67fc02e602c1cc5c99317
Fixed
760a2079b5c609038c826d24dfbcf9b0be98d987
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:python:*:*",
    "extracted_events": [
        {
            "introduced": "1.2.3"
        },
        {
            "fixed": "1.2.5"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

v1.*
v1.2.3
v1.2.4rc1
v1.2.5c1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-34824.json"