Nixpkgs security tracker
Untriaged
Permalink
CVE-2026-34824
7.5 HIGH
- CVSS version: 3.1
- Attack vector (AV): NETWORK
- Attack complexity (AC): LOW
- Privileges required (PR): NONE
- User interaction (UI): NONE
- Scope (S): UNCHANGED
- Confidentiality impact (C): NONE
- Integrity impact (I): NONE
- Availability impact (A): HIGH
Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service
Mesop is a Python-based UI framework that allows users to build web applications. From version 1.2.3 to before version 1.2.5, an uncontrolled resource consumption vulnerability exists in the WebSocket implementation of the Mesop framework. An unauthenticated attacker can send a rapid succession of WebSocket messages, forcing the server to spawn an unbounded number of operating system threads. This leads to thread exhaustion and Out of Memory (OOM) errors, causing a complete Denial of Service (DoS) for any application built on the framework. This issue has been patched in version 1.2.5.
References
-
https://github.com/mesop-dev/mesop/security/advisories/GHSA-3jr7-6hqp-x679 x_refsource_CONFIRM
-
https://github.com/mesop-dev/mesop/releases/tag/v1.2.5 x_refsource_MISC
Affected products
mesop
- ==>= 1.2.3, < 1.2.5
Package maintainers
-
@06kellyjac Jack <hello+nixpkgs@j-k.io>
-
@Ericson2314 John Ericson <John.Ericson@Obsidian.Systems>
-
@alejandrosame Alejandro Sánchez Medina <alejandrosanchzmedina@gmail.com>
-
@Artturin Artturi N <artturin@artturin.com>
-
@siraben Siraphob Phipathananunth <bensiraphob@gmail.com>
-
@emilytrau Emily Trau <emily+nix@downunderctf.com>