CVE-2026-105113
Received Received - Intake

Improper Locking in Nezha Dashboard Leading to DoS via Mutex Deadlock

Publication date: 2026-10-03

Last updated on: 2026-10-03

Assigner: VulnCheck

Description
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-03
Last Modified
2026-10-03
Generated
2026-10-03
AI Q&A
2026-10-03
EPSS Evaluated
N/A
NVD
CVE-2026-105113
EUVD
EUVD-2026-92017

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
nezha dashboard to 2.3.13 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-667 The product does not properly acquire or release a lock on a resource, leading to unexpected resource state changes and behaviors.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Nezha Dashboard versions 1.8.0 to 2.3.12 have an improper locking flaw where a non-deferred mutex unlock causes a nil-map panic. Authenticated non-admin users can trigger this by making four notification API calls, permanently deadlocking the alerting subsystem and exhausting memory with blocked requests.

Detection Guidance

Monitor for excessive memory usage or blocked API requests in Nezha Dashboard versions 1.8.0 to 2.3.12. Check for failed alert deliveries and notification subsystem failures. Look for increased open connections or unresponsive API endpoints.

Impact Analysis

This vulnerability allows any authenticated non-admin user to disable all alerting and notification functionality permanently. It blocks alert delivery for server incidents, TLS certificates, cron failures, and IP changes, causing resource exhaustion through increased memory usage and open connections.

Compliance Impact

This vulnerability primarily causes a denial of service by deadlocking the alerting subsystem, which could lead to undetected system failures. For GDPR, this may impact availability of monitoring systems required for breach detection. Under HIPAA, it could hinder timely alerting of security incidents affecting protected health information.

Mitigation Strategies

Upgrade Nezha Dashboard to version 2.3.13 or later immediately. If upgrading is not possible, restrict non-admin user access to the notification API endpoints to prevent exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105113. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart