AI Sec Watch: A Security Intelligence Platform for AI Systems

Luu, T.J.

GHSA-3jr7-6hqp-x679: Mesop: Unbounded Thread Creation in WebSocket Handler Leads to Denial of Service

highvulnerability

security

Source: GitHub Advisory DatabaseApril 3, 2026CVE-2026-34824

Summary

Mesop, a web framework, has a vulnerability in its WebSocket (a protocol for real-time two-way communication between client and server) handler where it creates a new operating system thread for every incoming message without any limits. An attacker can send thousands of messages rapidly, exhausting the server's thread capacity and causing an Out of Memory error that crashes the application for all users.

Solution / Mitigation

The source text recommends four mitigation strategies: (1) Use a bounded thread pool (such as ThreadPoolExecutor with max_workers), (2) Introduce per-connection rate limiting, (3) Implement a message queue with backpressure (preventing queue overflow by slowing down senders), or (4) Consider migrating to an async event loop model instead of spawning OS threads. No specific patch version or code fix is provided.