CVE-2026-77357: CWE-400: Uncontrolled Resource Consumption in mesop-dev mesop
Description
Mesop versions prior to 1.3.3 have an uncontrolled resource consumption vulnerability in debug mode via the /hot-reload endpoint. An unauthenticated attacker can supply a high counter parameter value to cause worker thread exhaustion, leading to server unavailability until manual restart. This denial-of-service condition is fixed in version 1.3.3.
CVSS v4.0
Score 8.7high
Affected software
mesop-dev
mesop
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Mesop, a Python-based UI framework, contains a denial-of-service vulnerability (CWE-400) in versions before 1.3.3. When running in debug mode, the GET /hot-reload endpoint processes a user-supplied counter parameter in an unbounded loop. An unauthenticated attacker can exploit this by providing a large counter value, causing worker threads to be held indefinitely and exhausting the worker pool. This results in the server becoming unresponsive until it is manually restarted. The issue is resolved in Mesop version 1.3.3.
Potential Impact
An unauthenticated attacker can cause a denial-of-service by exhausting server worker threads, rendering the Mesop server unavailable until manually restarted. This impacts availability but does not require authentication or user interaction.
Mitigation Recommendations
Upgrade Mesop to version 1.3.3 or later, where this vulnerability is fixed. Until then, avoid running Mesop in debug mode in production environments to reduce exposure.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-20T19:28:35.245Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a8e009bacd9273b49b2f919
Added to database: 08/25/2026, 20:52:43 UTC
Last enriched: 09/09/2026, 21:22:04 UTC
Last updated: 10/08/2026, 18:48:48 UTC
Views: 84
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.