Live › vulnerability › CVE-2026-111383
Go to dashboardNezha versions from 2.0.13 before 2.3.15 do not limit concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. An authenticated user can open thousands of subscriptions, exhausting file descriptors, memory and goroutines and blocking agent gRPC reconnections.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Teams that self-host the Nezha monitoring dashboard in versions from before are exposed, since the flaw is in the dashboard's WebSocket transfer endpoint. Exposure requires an authenticated user account on the dashboard. Installations already on or later are not affected.
2.0.132.3.152.3.15No product ranges from the sources yet.
2.0.13 or later but below 2.3.152.3.15 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
This page as .md · .json · in your agent: get_signal("CVE-2026-111383")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.