Resource Exhaustion Vulnerability in Nezha WebSocket API Endpoint
CVE-2026-111383

7.1HIGH

Key Information:

Vendor

Nezhahq

Status
Nezha
Vendor
CVE Published:
16 October 2026

What is CVE-2026-111383?

Nezha versions prior to 2.3.15 are vulnerable to a resource exhaustion issue that enables authenticated users to create unlimited concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. This flaw permits attackers to maintain numerous subscriptions generated by the ServerTransferClass.Subscribe method, leading to the exhaustion of file descriptors, memory resources, and goroutines. Consequently, this incident can disrupt agent gRPC reconnections, resulting in significant downtime and performance degradation.

Affected Version(s)

nezha 2.0.13 < 2.3.15

nezha 2.3.15

References

https://github.com/nezhahq/nezha/security/advisories/GHSA...
vendor-advisory
https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed78...
patch
https://www.vulncheck.com/advisories/nezha-2.0.13-before-...
third-party-advisory

CVSS V4

Score:
7.1
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

manus-use
.