EUVD-2026-101303

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant...

CVE-2026-100394 Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and...

CVE-2026-100394

Nezha Monitoring versions 2.2.7 through 2.2.11 are vulnerable to a nil pointer dereference in service/singleton/servicesentinel.go. The issue occurs when ServiceSentinel.worker accesses serviceStatusToday and serviceCurrentStatusData without revalidating if they were removed by ServiceSentinel.De...