Executive brief
Mesop is a Python web application framework that allows developers to build user interfaces. When running in debug mode, Mesop exposes an internal endpoint that does not properly validate request parameters, allowing an unauthenticated attacker to send requests that consume all available worker threads and crash the server. The application must be manually restarted to recover, causing service downtime for users.
Technical details
The vulnerability is a denial-of-service (DoS) flaw in the /__hot-reload__ endpoint exposed in debug mode. The endpoint processes a user-supplied counter parameter in an unbounded loop without proper validation, allowing an attacker to exhaust worker threads by sending requests with large counter values. The attack is unauthenticated and network-accessible, requiring no special privileges. An attacker can trigger worker pool exhaustion with minimal effort, rendering the server unresponsive. The issue is patched in version 1.3.3 by bounding the long-poll duration.
Affected products
- Google Mesop prior to 1.3.3
Timeline
- 2026-08-25: disclosed
- 2026-07-11: patched: Version 1.3.3 released with fix