CyberRota Analysis
AI-GeneratedApplications using the Mesop Python-based UI framework prior to version 1.3.3 are vulnerable to a denial-of-service attack via the exposed GET /hot-reload endpoint, which can be exploited by unauthenticated attackers to exhaust server worker threads. This results in server unavailability until a manual restart is performed. Organizations utilizing Mesop should prioritize upgrading to version 1.3.3 to mitigate this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Mesop is a Python-based UI framework that allows users to build web applications. Prior to 1.3.3, applications running in debug mode expose a GET /hot-reload endpoint whose unbounded loop depends on the user-supplied counter parameter, allowing an unauthenticated attacker to hold worker threads with high counter values until the worker pool is exhausted and the server becomes unavailable. A single unauthenticated attacker can crash the Mesop server with minimal effort. Because the attack leverages worker exhaustion, the server remains unresponsive until it is manually restarted. This issue is fixed in version 1.3.3.