CVE-2026-34824 Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
An unauthenticated attacker can cause a Denial of Service in Mesop applications by sending rapid WebSocket messages that exhaust system threads.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-34824?
CVE-2026-34824 is a high-severity denial of service vulnerability in mesop-dev mesop, published on 3 Apr 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.
Which versions are affected by CVE-2026-34824?
3 open source packages ship an affected version, including mesop. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mesop PyPI | From 1.2.3 | 1.2.5 |
mesop PyPI | From 1.2.3 | 1.2.5 |
mesop PyPI | From 1.2.3 | 1.2.5 |
Products include Mesop-Dev Mesop.
How do I fix CVE-2026-34824?
Upgrade mesop to 1.2.5 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-34824 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-34824 exists.
Other vulnerabilities in mesop-dev mesop
Sources
Also known as GHSA-3jr7-6hqp-x679, PYSEC-2026-2204.