CVE-2026-111384
Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
- State
- Published
- Severity
- 7.1 High
- Published
- Oct 16, 2026
- Updated
- Oct 23, 2026
- Reserved
- Oct 15, 2026
Description
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 4.0 | 7.1 High | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N | VulnCheck |
| 3.1 | 6.5 Medium | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | VulnCheck |
Weaknesses
- CWE-770 Allocation of Resources Without Limits or Throttling
Affected Products
| Product | Versions |
|---|---|
nezhanezhahq |
|
References
- GitHub Security Advisory (GHSA-7242-982f-83p9)vendor-advisory
- Patch Commitpatch
- VulnCheck Advisory: Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocketthird-party-advisory
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.