CVE-2026-111383 — Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer …
Published: 2026-10-16 · CVSS: 7.1 · CVSS 4.0
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7