Vulnerability · Published Oct 16, 2026 · Assigned by VulnCheck

CVE-2026-111383Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

Medium 6.5

In plain English

A medium-severity resource allocation without limits in nezha from nezhahq. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 30% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 70.3% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.

Affected products (as reported)

Vendor	Product	Versions
nezhahq	nezha	2.0.13 – before 2.3.15

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

GitHub Security Advisory (GHSA-ch6h-w872-77mx) vendor-advisory
Patch Commit patch
VulnCheck Advisory: Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket third-party-advisory