CVE-2026-77357 Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server
An unauthenticated attacker can crash the Mesop server by exhausting worker threads via the hot-reload endpoint in debug mode.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-77357?
CVE-2026-77357 is a high-severity denial of service vulnerability in mesop-dev mesop, published on 25 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads with high counter values until the worker pool is exhausted and the server becomes unavailable. A single unauthenticated attacker can crash the Mesop server with minimal effort. Because the attack leverages worker exhaustion, the server remains unresponsive until it is manually restarted. This issue is fixed in version 1.3.3.
Which versions are affected by CVE-2026-77357?
How do I fix CVE-2026-77357?
No fix has been published for CVE-2026-77357 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-77357 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-77357 exists.
Sources
Also known as GHSA-8p72-497j-83mx.