Read the docs
TI-2026-65118 Aliases CVE-2026-101085GHSA-5j6x-8f94-88gc

Nezha before 2.3.8 Denial of Service via Alert Rule

Priority MEDIUM 64CWE-197Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint to crash the dashboard process, which persists the rule and causes repeated crashes on restart, disabling all monitoring and control plane functionality.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00301 22nd percentileScored 2026-11-07
Fix Fixed nezha (nezhahq): 2.3.8

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
nezhahqnezhabefore 2.3.82.3.8Patch availableCNA
  • nezha Vendornezhahq Affected before 2.3.8 Fixed in 2.3.8 Patch available CNA

Remediation

  • Fix · CNA nezha (nezhahq) Fixed in 2.3.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-101085
  2. 2026-10-03 Alias added: GHSA-5j6x-8f94-88gc

References

Advisory 1

  • TI-2026-65123 Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri CVSS 4.0CRITICAL 9.3
  • TI-2026-34341 Nezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron CVSS 3.1CRITICAL 9.9
  • TI-2026-34342 Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification CVSS 3.1HIGH 7.7
  • TI-2026-38597 Nezha Monitoring: OAuth2 Redirect URL — Host Header Injection CVSS 3.1MEDIUM 6.8
  • TI-2026-75131 Memory exhaustion in Nezha file manager WebSocket endpoint CVSS 4.0HIGH 7.1
  • TI-2026-75130 Nezha WebSocket transfer endpoint flaw enables denial of service CVSS 4.0HIGH 7.1
See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences