{"schema":"threatline.record/2","record":{"id":"CVE-2026-101088","aliases":["GHSA-jx78-55p5-rwv5"],"summary":"Nezha before 2.3.1 Denial of Service via Concurrent Server Delete","details":"Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go) contains an incomplete fix for a previously reported nil dereference denial of service (GHSA-qjpp-gffx-2wm9). The 2026-07-21 fix re-validated the service lifecycle under serviceResponseDataStoreLock but reused an already-captured, now stale reporter pointer and never re-validated the server, and that lock does not guard ServerShared. An authenticated user with the member role who owns an agent can issue a concurrent server delete (POST /api/v1/batch-delete/server) for their own server to win the race window, causing the worker to dereference a missing entry in the server list snapshot. Because the sentinel workers and the gRPC server have no recover()/recovery interceptor, the resulting panic is unrecovered and crashes the entire instance. This is fixed in version 2.3.1.","categories":["Unclassified"],"product":"nezha","vendor":"nezhahq","ecosystem":null,"affected_ranges":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101088","source_modified_at":"2026-09-30T22:13:47.785Z","fetched_at":"2026-10-23T18:52:38.922436Z","product":"nezha","vendor":"nezhahq","versions":[{"version":"2.2.11","status":"affected","versionType":"semver","lessThan":"2.3.1"},{"version":"2.3.1","status":"unaffected","versionType":"semver"}],"defaultStatus":"unaffected"}],"fixed_versions":[{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-101088","source_modified_at":"2026-09-30T22:13:47.785Z","fetched_at":"2026-10-23T18:52:38.922436Z","package":{"name":"nezha","ecosystem":null},"version":"2.3.1","basis":"first unaffected version stated in the CVE record"}],"cvss":6,"severity":"Medium","kev":{"listed":false},"epss":{"probability":0.00182,"percentile":0.07372,"score_date":"2026-10-23"},"published_at":"2026-09-27T20:49:59.487Z","modified_at":"2026-09-30T22:13:47.785Z","provenance":[{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-101088","fetched_at":"2026-10-23T18:52:38.922436Z","source_modified_at":"2026-09-30T22:13:47.785Z"},{"source":"EPSS","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-101088","fetched_at":"2026-10-23T18:42:43.628194Z","source_modified_at":"2026-10-23"}],"sources":["CVE List","EPSS"],"references":[{"source":"CVE List","url":"https://github.com/nezhahq/nezha/security/advisories/GHSA-jx78-55p5-rwv5","tags":["vendor-advisory"]},{"source":"CVE List","url":"https://www.vulncheck.com/advisories/nezha-before-2.3.1-denial-of-service-via-concurrent-server-delete","tags":["third-party-advisory"]}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","cvss_source":"CVE List","ssvc":{"exploitation":"none","automatable":"no","technical_impact":"partial","assessed_at":"2026-09-30T22:13:38.135868Z"},"classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":null,"confidence":"unknown","reviewed":false},"change_timestamp":"2026-09-30T22:13:47.785Z","content_hash":"11e6cd54d3a25aeec7047f4cf9c6d64c00748787ab86359b67a063aec6e87cb2"}}