CVE-2026-105112

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

EUVD-2026-92016

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

CVE-2026-105112 Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

CVE-2026-105112

The Nezha monitoring agent, versions 1.8.0 before 2.3.13 , is vulnerable to a lock-order inversion within the UpdateGroup and DeleteGroup functions. This flaw allows authenticated non-admin users to trigger a deadlock in the alerting subsystem . By concurrently calling the notification-group and ...

PT-2026-104573

Name of the Vulnerable Software and Affected Versions Nezha versions 1.8.0 through 2.3.12 Description A lock-order inversion exists within the UpdateGroup and DeleteGroup functions. This flaw allows authenticated users without administrative privileges to cause a deadlock in the alerting subsyste...