Vulnerability · Published Oct 3, 2026 · Assigned by VulnCheck
CVE-2026-105113Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock
Medium 6.5
In plain English
A medium-severity security flaw in nezha from nezhahq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities).
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)0.2%top 84.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.
Affected products (as reported)
Weakness: CWE-667 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
References
- GitHub Security Advisory (GHSA-7j7v-j77m-6g3m) vendor-advisory
- VulnCheck Advisory: Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock third-party-advisory