CVE-2026-105113

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105112

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

CVE-2026-105113

The Nezha Dashboard (versions 1.8.0 before 2.3.13) is vulnerable to an improper locking issue (CWE-667). The root cause is a non-deferred mutex unlock that leaks during a nil-map panic path . An authenticated non-admin member can trigger this by making four specific notification API calls, result...

CVE-2026-105113 Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105112

The Nezha monitoring agent, versions 1.8.0 before 2.3.13 , is vulnerable to a lock-order inversion within the UpdateGroup and DeleteGroup functions. This flaw allows authenticated non-admin users to trigger a deadlock in the alerting subsystem . By concurrently calling the notification-group and ...

EUVD-2026-92016

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

CVE-2026-105112 Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

PT-2026-104573

Name of the Vulnerable Software and Affected Versions Nezha versions 1.8.0 through 2.3.12 Description A lock-order inversion exists within the UpdateGroup and DeleteGroup functions. This flaw allows authenticated users without administrative privileges to cause a deadlock in the alerting subsyste...

CVE-2026-105113: Improper Locking

Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with...

CVE-2026-105112: Concurrent Execution using Shared Resource with Improper Synchronization

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race a...

PT-2026-104574

Name of the Vulnerable Software and Affected Versions Nezha Dashboard versions 1.8.0 through 2.3.12 Description An improper locking issue exists where a non-deferred mutex unlock leaks during a nil-map panic path. An authenticated non-admin member can exploit this by issuing four notification API...