CVE-2026-77357: Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads with high counter values until the worker pool is exhausted and the server becomes unavailable. A single unauthenticated attacker can crash the Mesop server with minimal effort. Because the attack leverages worker exhaustion, the server remains unresponsive until it is manually restarted. This issue is fixed in version 1.3.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Mesopto a version that resolves this vulnerability.Fixed in 1.3.3
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service condition?
Mesop applications running in debug mode are exposed when using versions prior to 1.3.3, because debug mode exposes the GET /hot-reload endpoint.
What does an attacker need to exploit it?
The attacker only needs unauthenticated access to the exposed /hot-reload endpoint and can supply high counter values to keep worker threads occupied. A single attacker can exhaust the worker pool with minimal effort.
What is the operational impact after exploitation?
Once worker threads are exhausted, the Mesop server becomes unavailable and remains unresponsive until it is manually restarted.
What version resolves the issue?
Mesop version 1.3.3 fixes this issue.