CVE-2026-34824

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34824", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T20:52:53.283Z", "datePublished": "2026-04-03T22:41:34.828Z", "dateUpdated": "2026-04-06T15:42:06.793Z"}, "containers": {"cna": {"title": "Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service", "problemTypes": [{"descriptions": [{"cweId": "CWE-125", "lang": "en", "description": "CWE-125: Out-of-bounds Read", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679"}, {"name": "https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987", "tags": ["x_refsource_MISC"], "url": "https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987"}, {"name": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.5", "tags": ["x_refsource_MISC"], "url": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.5"}], "affected": [{"vendor": "mesop-dev", "product": "mesop", "versions": [{"version": ">= 1.2.3, < 1.2.5", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-03T22:41:34.828Z"}, "descriptions": [{"lang": "en", "value": "Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5."}], "source": {"advisory": "GHSA-3jr7-6hqp-x679", "discovery": "UNKNOWN"}}, "adp": [{"references": [{"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-06T15:36:21.198461Z", "id": "CVE-2026-34824", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:42:06.793Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34824", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:36:21.198461Z"}}}], "references": [{"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-06T15:36:29.638Z"}}], "cna": {"title": "Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service", "source": {"advisory": "GHSA-3jr7-6hqp-x679", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "mesop-dev", "product": "mesop", "versions": [{"status": "affected", "version": ">= 1.2.3, < 1.2.5"}]}], "references": [{"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679", "name": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987", "name": "https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.5", "name": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.5", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-125", "description": "CWE-125: Out-of-bounds Read"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-03T22:41:34.828Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34824", "state": "PUBLISHED", "dateUpdated": "2026-04-06T15:42:06.793Z", "dateReserved": "2026-03-30T20:52:53.283Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-03T22:41:34.828Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "mesop", "vendor": "mesop-dev", "versions": [{"status": "affected", "version": ">= 1.2.3, < 1.2.5"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:python:*:*", "matchCriteriaId": "4769E8D1-F88C-4A75-8FAF-134F1A0B7DE0", "versionEndExcluding": "1.2.5", "versionStartIncluding": "1.2.3", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5."}, {"lang": "es", "value": "Mesop es un framework de UI basado en Python que permite a los usuarios construir aplicaciones web. Desde la versi\u00f3n 1.2.3 hasta antes de la versi\u00f3n 1.2.5, existe una vulnerabilidad de consumo de recursos no controlado en la implementaci\u00f3n de WebSocket del framework Mesop. Un atacante no autenticado puede enviar una r\u00e1pida sucesi\u00f3n de mensajes WebSocket, forzando al servidor a generar un n\u00famero ilimitado de hilos del sistema operativo. Esto lleva al agotamiento de hilos y errores de Out of Memory (OOM), causando una denegaci\u00f3n de servicio (DoS) completa para cualquier aplicaci\u00f3n construida sobre el framework. Este problema ha sido parcheado en la versi\u00f3n 1.2.5."}], "id": "CVE-2026-34824", "lastModified": "2026-07-24T22:10:00.140", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34824", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-04-06T15:36:21.198461Z", "version": "2.0.3"}}]}, "published": "2026-04-03T23:17:05.213", "references": [{"source": "security-advisories@github.com", "tags": ["Patch"], "url": "https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987"}, {"source": "security-advisories@github.com", "tags": ["Product", "Release Notes"], "url": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.5"}, {"source": "security-advisories@github.com", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-125"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-770"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.2.3,1.2.5)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "cna", "scores": [{"score": 100.0, "source": "cna"}]}, "original": {"product": "mesop", "source": "cna", "vendor": "mesop-dev"}, "product": "mesop", "vendor": "mesop-dev"}], "analysis": {"en": {"generated_at": "2026-04-13T19:10:46.813420+00:00", "value": {"mitigation_remediation": ["Apply the Mesop 1.2.5 patch or later.", "If patching is delayed, limit the rate of incoming WebSocket messages by implementing connection throttling.", "Configure the server to cap the maximum number of concurrent threads or use a thread\u2011pool with a predefined upper bound.", "Monitor thread usage and memory consumption for signs of exhaustion, and set alerts for sudden spikes.", "Review and log WebSocket activity to detect anomalous patterns for future investigation."], "summary": {"action": "Immediate Patch", "impact": "Denial of Service via unbounded thread creation"}, "threat_synthesis": {"affected_systems": "The vulnerability affects the Mesop framework, released under the mesop\u2011dev:mesop product name. Versions from 1.2.3 up to, but not including, 1.2.5 are vulnerable. Applications built with these versions and deployed on any Python runtime are at risk until the issue is patched to 1.2.5 or later.", "description_and_impact": "An unauthenticated attacker can send a rapid succession of WebSocket messages to the Mesop framework, causing the server to spawn an unbounded number of operating system threads. This uncontrolled resource consumption leads to thread exhaustion and out\u2011of\u2011memory errors, resulting in a complete denial of service for any application built on the framework. The weakness is consistent with CWE\u2011125 and CWE\u2011770.", "risk_and_exploitability": "This issue carries a CVSS score of 7.5, which represents a high impact. The EPSS score is reported as less than 1\u202f%, indicating a low current likelihood of exploitation. It is not listed in the CISA KEV catalog. The vulnerability can be exploited by an unauthenticated attacker over the network by transmitting a rapid stream of WebSocket messages, requiring no prior access or privileged credentials."}}}}, "created": "2026-04-06T21:22:02.500297+00:00", "updated": "2026-04-14T16:41:32.076272+00:00", "vendors": ["mesop-dev", "mesop-dev$PRODUCT$mesop"]}