Quick answers
- Is CVE-2026-34824 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-34824 being exploited in the wild.
- How severe is CVE-2026-34824?
- High severity, with a CVSS score of 7.5, published 3 April 2026.
- Which products and versions are affected?
- mesop (PyPI) >= 1.2.3, < 1.2.5, ECOSYSTEM:introduced=1.2.3,fixed=1.2.5.
- Is there a fix for CVE-2026-34824?
- Yes. mesop (PyPI): upgrade to 1.2.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-34824 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-34824?
- Check whether you run mesop (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- mesop (PyPI): upgrade to 1.2.5 or later
pip install "mesop>=1.2.5"
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in the Mesop framework's WebSocket handler within `mesop/server/server.py`. The `handle_websocket` function fails to implement rate limiting or thread pooling, instead spawning a new `threading.Thread` for every incoming `ui_request`. A remote, unauthenticated attacker can exploit this by sending a high volume of WebSocket messages in rapid succession. This leads to the exhaustion of operating system threads and memory (OOM), resulting in a complete Denial of Service (DoS). The vulnerability is addressed in version 1.2.5 by bounding concurrent WebSocket threads per connection.
Affected products
- mesop-dev Mesop >= 1.2.3, < 1.2.5
Identifiers
- CVE-2026-34824
- GHSA-3jr7-6hqp-x679
- PYSEC-2026-2204
Timeline
- 2026-03-31: patched: Version 1.2.5 released
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD