Executive brief
Mesop is a Python framework used by developers to build web-based user interfaces. A security flaw in how the framework handles real-time communications (WebSockets) allows an attacker to crash the application by sending a flood of messages. This results in a total service outage, making the application unavailable to legitimate users and potentially crashing the server it runs on.
Technical details
An uncontrolled resource consumption vulnerability (CWE-400) exists in the Mesop framework's WebSocket handler within `mesop/server/server.py`. The `handle_websocket` function fails to implement rate limiting or thread pooling, instead spawning a new `threading.Thread` for every incoming `ui_request`. A remote, unauthenticated attacker can exploit this by sending a high volume of WebSocket messages in rapid succession. This leads to the exhaustion of operating system threads and memory (OOM), resulting in a complete Denial of Service (DoS). The vulnerability is addressed in version 1.2.5 by bounding concurrent WebSocket threads per connection.
Affected products
- mesop-dev Mesop >= 1.2.3, < 1.2.5
Timeline
- 2026-03-31: patched: Version 1.2.5 released
- 2026-04-02: advisory: GitHub Security Advisory published
- 2026-04-03: disclosed: CVE published to NVD