All vulnerabilities
CVE-2026-105112GHSA-53vr-p24v-qvwf

Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

nezhahq nezha
Open in ThreatlineRecord JSON
CVSS
6.0Medium
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 5 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.18%Chance of exploitation activity in the next 30 days, higher than 7% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.3.13Fixed versionCVE List
Published3 Oct 2026Updated 5 Oct 2026CVE List

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.

Text from CVE List

Affected versions 2

  • nezhaaffected: 1.8.0 before 2.3.13CVE List
  • nezhaunaffected: 2.3.13CVE List

References 2