Mesop
Monthly
Worker-thread exhaustion in Mesop's debug-mode hot-reload endpoint (prior to version 1.3.3) allows an unauthenticated remote attacker to render the server completely unavailable with minimal effort. The GET /hot-reload endpoint in debug mode enters an unbounded loop controlled by the attacker-supplied counter parameter, holding worker threads indefinitely until the thread pool is exhausted and the server stops responding to all requests. Recovery requires a manual server restart. No public exploit has been identified at time of analysis, but the attack mechanism is trivially simple and fully automatable.
Worker-thread exhaustion in Mesop's debug-mode hot-reload endpoint (prior to version 1.3.3) allows an unauthenticated remote attacker to render the server completely unavailable with minimal effort. The GET /hot-reload endpoint in debug mode enters an unbounded loop controlled by the attacker-supplied counter parameter, holding worker threads indefinitely until the thread pool is exhausted and the server stops responding to all requests. Recovery requires a manual server restart. No public exploit has been identified at time of analysis, but the attack mechanism is trivially simple and fully automatable.