CVE-2026-34824

{"id": "CVE-2026-34824", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34824", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-04-06T15:36:21.198461Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "mesop-dev", "product": "mesop", "versions": [{"status": "affected", "version": ">= 1.2.3, < 1.2.5"}]}]}], "published": "2026-04-03T23:17:05.213", "references": [{"url": "https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mesop-dev/mesop/releases/tag/v1.2.5", "tags": ["Product", "Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "security-advisories@github.com"}, {"url": "https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679", "tags": ["Exploit", "Mitigation", "Vendor Advisory"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-125"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-770"}]}], "descriptions": [{"lang": "en", "value": "Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5."}, {"lang": "es", "value": "Mesop es un framework de UI basado en Python que permite a los usuarios construir aplicaciones web. Desde la versi\u00f3n 1.2.3 hasta antes de la versi\u00f3n 1.2.5, existe una vulnerabilidad de consumo de recursos no controlado en la implementaci\u00f3n de WebSocket del framework Mesop. Un atacante no autenticado puede enviar una r\u00e1pida sucesi\u00f3n de mensajes WebSocket, forzando al servidor a generar un n\u00famero ilimitado de hilos del sistema operativo. Esto lleva al agotamiento de hilos y errores de Out of Memory (OOM), causando una denegaci\u00f3n de servicio (DoS) completa para cualquier aplicaci\u00f3n construida sobre el framework. Este problema ha sido parcheado en la versi\u00f3n 1.2.5."}], "lastModified": "2026-07-24T22:10:00.140", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:python:*:*", "vulnerable": true, "matchCriteriaId": "4769E8D1-F88C-4A75-8FAF-134F1A0B7DE0", "versionEndExcluding": "1.2.5", "versionStartIncluding": "1.2.3"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}