CVE-2026-111383GHSA-ch6h-w872-77mx
Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
nezhahq nezha
CVSS
7.1HighExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 16 Oct 2026. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.29%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
What fixes it
- 2.3.15nezhaCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
Text from CVE List
Affected versions 2
- nezhaaffected: 2.0.13 before 2.3.15CVE List
- nezhaunaffected: 2.3.15CVE List