CVE-2026-111384Medium· 6.5▾ SunlitNezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 35.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
nezha >= 1.0.0 < 2.3.15Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-111383Medium· 6.5Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
CVE-2026-111387Medium· 6.5Nezha 2.2.5 before 2.3.15 Information Disclosure via DDNS List Endpoint
CVE-2026-111385Medium· 4.8Nezha 2.1.0 before 2.3.15 Host Header Injection via MCP Transfer Tools
CVE-2026-111386Medium· 4.3Nezha 1.7.0 before 2.3.15 Cross-Tenant Server-ID Enumeration via getServerConfig
CVE-2026-100394Medium· 6.5Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool
CVE-2026-105112Medium· 5.3Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem