CVE-2026-111383

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383 Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383 Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383

The Nezha monitoring tool (versions 2.0.13 before 2.3.15 ) is vulnerable to a resource exhaustion flaw. Authenticated users can exploit the /api/v1/ws/transfer WebSocket endpoint to open unbounded concurrent connections. Specifically, the ServerTransferClass.Subscribe function allows the creation...

EUVD-2026-102564

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

PT-2026-115389

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-111383: Allocation of Resources Without Limits or Throttling

Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limit...

CVE-2026-44618

A flaw was found in Apache CXF. An insecure XML parser configuration within Apache CXF's WS-Transfer module may allow a remote attacker to perform XML External Entity XXE attacks. This could lead to information disclosure, denial of service, or server-side request forgery. Mitigation If using...

org.apache.cxf:apache-cxf (>=4.1.0, <=4.1.5), org.apache.cxf:cxf-distribution-javadoc (>=4.1.0, <=4.1.5) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=4.1.0, <=4.1.5)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =4.1.0, =4.1.0, =4.1.0, =4.1.5 Source cves: CVE-2026-44618 Source advisory: GHSA-VMM5-FJGX-2JHP...

GHSA-VMM5-FJGX-2JHP Apache CXF's WS-Transfer module has an insecure XML parser configuration

Insecure XML parser configuration in Apache CXF's WS-Transfer module may allow attackers to perform XXE attacks. Users are recommended to upgrade to versions 4.2.1, 4.1.6 or 3.6.11, which fix this issue...

org.apache.cxf:apache-cxf (4.2.0), org.apache.cxf:cxf-distribution-javadoc (4.2.0) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (4.2.0)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-ws-transfer and may be impacted: - org.apache.cxf:apache-cxf 4.2.0 - org.apache.cxf:cxf-distribution-javadoc 4.2.0 Source cves:...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: GHSA-VMM5-FJGX-2JHP...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: OSV:GHSA-VMM5-FJGX-2JHP...

org.apache.cxf:apache-cxf (4.2.0), org.apache.cxf:cxf-distribution-javadoc (4.2.0) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (4.2.0)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-ws-transfer and may be impacted: - org.apache.cxf:apache-cxf 4.2.0 - org.apache.cxf:cxf-distribution-javadoc 4.2.0 Source cves:...

org.apache.cxf:apache-cxf (>=4.1.0, <=4.1.5), org.apache.cxf:cxf-distribution-javadoc (>=4.1.0, <=4.1.5) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=4.1.0, <=4.1.5)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =4.1.0, =4.1.0, =4.1.0, =4.1.5 Source cves: CVE-2026-44618 Source advisory: OSV:GHSA-VMM5-FJGX-2JHP...

org.apache.cxf:apache-cxf (>=4.0.0, <=4.1.5), org.apache.cxf:cxf-distribution-javadoc (>=4.0.0, <=4.1.5) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=4.0.0, <=4.1.5)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.1.5 Source cves: CVE-2026-44618 Source advisory: SNYK:JAVA-ORGAPACHECXF-17115402...

org.apache.cxf:apache-cxf (4.2.0), org.apache.cxf:cxf-distribution-javadoc (4.2.0) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (4.2.0)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version 4.2.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.cxf:cxf-rt-ws-transfer and may be impacted: - org.apache.cxf:apache-cxf 4.2.0 - org.apache.cxf:cxf-distribution-javadoc 4.2.0 Source cves:...

com.github.vindell:spring-boot-starter-cxf-jaxws-plus (>=1.0.0.release, <=1.0.2.release), org.apache.cxf:apache-cxf (>=3.3.0, <=3.6.10) +1 more potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=3.2.4, <=3.6.10)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =3.2.4, =1.0.0.release, =3.3.0, =3.4.0, =3.6.10 Source cves: CVE-2026-44618 Source advisory: SNYK:JAVA-ORGAPACHECXF-17115402...

org.apache.cxf:apache-cxf (>=4.0.0, <=4.1.5), org.apache.cxf:cxf-distribution-javadoc (>=4.0.0, <=4.1.5) potentially affected by CVE-2026-44618 via org.apache.cxf:cxf-rt-ws-transfer (>=4.0.0, <=4.1.5)

org.apache.cxf:cxf-rt-ws-transfer MAVEN version =4.0.0, =4.0.0, =4.0.0, =4.1.5 Source cves: CVE-2026-44618 Source advisory: MEND:CVE-2026-44618...