Denial of Service Vulnerability in Nezha Server Monitoring Tool

CVE-2026-101088

What is CVE-2026-101088?

The Nezha Server Monitoring Tool has a vulnerability in its service sentinel worker that can lead to a denial of service. In the affected versions ranging from 2.2.11 to 2.3.0, an authenticated user with the member role can exploit a race condition during a server deletion process. This occurs when the user initiates a concurrent delete request for their own server while the sentinel worker fails to properly validate the state of the server resource. This oversight allows for dereferencing a missing entry in a server list snapshot, resulting in an unrecoverable panic that crashes the entire instance. This issue was addressed in version 2.3.1 of the product.

References