Skip to content
CVE PROGRAM SOURCE RECORD7.1 High

CVE-2026-111384

Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
VulnCheck

Description

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

nezhahq nezha

Default version status: unaffected

  • 1.0.0 to < 2.3.15affected
  • 2.3.15unaffected
pkg:golang/github.com/nezhahq/nezha

References