CVE-2026-105113 — Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin …
Published: 2026-10-03 · CVSS: 7.1 · CVSS 4.0
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7