Vulnerability · Published Oct 30, 2026 · Assigned by VulnCheck

CVE-2026-120046Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History

Medium 5.3

In plain English

A medium-severity null pointer dereference in nezha from nezhahq. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 23% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)0.3%top 77.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.

Affected products (as reported)

Vendor	Product	Versions
nezhahq	nezha	2.0.0 – before 2.4.0

Weakness: CWE-476 · Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References

Patch Commit patch
nezha v2.4.0 Release Notes release-notes
loadTodayStats unchecked map dereference (2.3.18) technical-description
Service deletion leaves service_histories rows (2.3.18) technical-description
https://github.com/nezhahq/nezha product
VulnCheck Advisory: Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History third-party-advisory