CVE-2026-105113
published 2026-10-03CVE-2026-105113: Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any…
PriorityP334medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.20%
9.0th percentile
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| nezhahq | nezha | >= 1.8.0 < 2.3.13 | 2.3.13 |
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv4.07.1HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VulDB
nezhahq Nezha up to 2.3.12 Alerting Subsystem deadlock
vuldb·2026-10-03·CVSS 6.5
CVE-2026-105113 [MEDIUM] nezhahq Nezha up to 2.3.12 Alerting Subsystem deadlock
A vulnerability categorized as problematic has been discovered in nezhahq Nezha up to 2.3.12. Affected by this vulnerability is an unknown functionality of the component Alerting Subsystem. The manipulation results in deadlock.
This vulnerability was named CVE-2026-105113. The attack may be performed from remote. There is no available exploit.
It is advisable to upgrade the affected component.
GHSA
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path.
ghsa_unreviewed·2026-10-03
CVE-2026-105113 [HIGH] CWE-667 Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path.
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2026-10-03
Published