Read the docs
TI-2026-53977 Aliases CVE-2026-77357

Mesop: DoS in /hot-reload endpoint allows unauthenticated attacker to exhaust worker threads and crash the server

Priority HIGH 77CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-400.

Summary

Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads with high counter values until the worker pool is exhausted and the server becomes unavailable. A single unauthenticated attacker can crash the Mesop server with minimal effort. Because the attack leverages worker exhaustion, the server remains unresponsive until it is manually restarted. This issue is fixed in version 1.3.3.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00529 44th percentileScored 2026-11-07
Fix Fixed mesop (mesop-dev): 1.3.3

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mesop-devmesopbefore 1.3.31.3.3Patch availableCNA
  • mesop Vendormesop-dev Affected before 1.3.3 Fixed in 1.3.3 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:*:*:*——mesop-dev
  • cpe:2.3:a:mesop-dev:mesop:*:*:*:*:*:*:*:* Versions — — ·mesop-dev

Remediation

  • Fix · CNA mesop (mesop-dev) Fixed in 1.3.3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-77357

References

Other 3

  • TI-2026-25500 Mesop Affected by Unauthenticated Remote Code Execution via Test Suite Route /exec-py CVSS 3.1CRITICAL 9.8
  • TI-2026-25497 Mesop: Path Traversal utilizing `FileStateSessionBackend` leads to Application Denial of Service and File Write/Deletion CVSS 3.1CRITICAL 10.0
  • TI-2026-27068 Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service CVSS 3.1HIGH 7.5
  • TI-2025-21664 Mesop Class Pollution vulnerability leads to DoS and Jailbreak attacks CVSS 3.1HIGH 8.1
  • TI-2026-62971 Mesop: Unauthenticated ANSI Escape Sequence Injection in CSP Reporting Endpoint CVSS 4.0MEDIUM 5.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences