https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:06:10.175747+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/cve-2026-34824 CVE-2026-34824 — Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service 2026-10-02T22:06:10.177717+00:00

Affected: mesop-dev mesop

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.

 https://cve.radiocsirt.org/vuln/ghsa-3jr7-6hqp-x679 GHSA-3jr7-6hqp-x679 — Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service 2026-10-02T22:06:10.177781+00:00

Affected: PyPI: mesop

### Summary An uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework.

### Details The vulnerability stems from an architectural flaw in how incoming WebSocket messages are processed. In the `mesop/server/server.py` file, the `handle_websocket` function listens for incoming messages and immediately spawns a new `threading.Thread` for every successfully parsed `ui_request`.

There is no thread pool, message queue, or rate-limiting mechanism implemented to restrict the number of concurrent threads spawned per connection.

*Vulnerable code snippet in `mesop/server/server.py`:* ```python while True: message = ws.receive() if not message: continue # ... message parsing logic ...

# VULNERABILITY: Spawning a new thread for every single message without limits thread = threading.Thread( target=copy_current_request_context(ws_generate_data), args=(ws, ui_request), daemon=True, ) thread.start() ``` ### PoC To reproduce this vulnerability, you only need a running instance of a Mesop application and a basic Python script to flood the WebSocket endpoint.

Prerequisites:…