Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-105113

Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nezhahq nezha

Default version status: unaffected

  • 1.8.0 to < 2.3.13affected
  • 2.3.13unaffected
pkg:golang/github.com/nezhahq/nezha

References