CVE-2026-34824

Katalog CVE

CVSS 7.5 · High EPSS 0,67%

Kerentanan Out-of-bounds Read pada mesop-dev mesop. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.

Rincian

Terbit di NVD

3 April 2026

Terakhir diubah

24 Juli 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-125: Out-of-bounds Read
CWE-770: Allocation of Resources Without Limits or Throttling

EPSS (30 hari)

0,67% peluang dieksploitasi; lebih tinggi dari 50,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679 exploit · mitigasi · advisory vendor
• https://github.com/mesop-dev/mesop/commit/760a2079b5c609038c826d24dfbcf9b0be98d987 patch
• https://github.com/mesop-dev/mesop/releases/tag/v1.2.5 product · release notes