CVE-2026-77357

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-77357
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77357.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-77357
Aliases
  • GHSA-8p72-497j-83mx
Published
2026-08-25T20:40:39.711Z
Modified
2026-08-28T11:30:34.488624183Z
Severity
  • 8.7 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server
Details

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads with high counter values until the worker pool is exhausted and the server becomes unavailable. A single unauthenticated attacker can crash the Mesop server with minimal effort. Because the attack leverages worker exhaustion, the server remains unresponsive until it is manually restarted. This issue is fixed in version 1.3.3.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/77xxx/CVE-2026-77357.json",
    "cwe_ids": [
        "CWE-400",
        "CWE-834"
    ],
    "cna_assigner": "GitHub_M"
}
References

Affected packages

Git / github.com/mesop-dev/mesop

Affected ranges

Type
GIT
Repo
https://github.com/mesop-dev/mesop
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
2b8e7f2c349c9e2eec202f46b07bada83061ce2d
Fixed
8f7e1e230975f6f763a090f647d34a4cad7977c1
Database specific
Show details 
{
    "source": [
        "AFFECTED_FIELD",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.3"
        }
    ]
}

Affected versions

v0.*
v0.1
v0.10.0
v0.11.0
v0.11.1
v0.12.0
v0.12.1
v0.12.2
v0.12.3
v0.12.4
v0.12.5
v0.12.6
v0.12.7
v0.12.8
v0.12.9
v0.13.0
v0.14.0
v0.14.1
v0.14.2rc1
v0.14.2rc1-try2
v0.14.2rc1-try3
v0.2
v0.4.1
v0.4.2
v0.5
v0.5.3
v0.5.5
v0.5.6
v0.6.0
v0.7.1
v0.7.2
v0.8.0
v0.9.0
v0.9.1
v0.9.2
v0.9.3
v0.9.4
v0.9.5
v1.*
v1.0.0
v1.0.0rc1
v1.0.0rc2
v1.0.1
v1.0.1rc1
v1.1.0
v1.1.0rc1
v1.1.1
v1.1.1rc1
v1.1.1rc2
v1.1.1rc3
v1.2.0
v1.2.0rc1
v1.2.1
v1.2.1rc1
v1.2.2
v1.2.2rc1
v1.2.3
v1.2.4rc1
v1.2.5
v1.2.5c1
v1.2.6
v1.2.6rc1
v1.2.6rc2
v1.2.7
v1.2.7rc1
v1.3.0
v1.3.0rc1
v1.3.0rc2
v1.3.1
v1.3.2

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-77357.json"