Description
Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go) contains an incomplete fix for a previously reported nil dereference denial of service (GHSA-qjpp-gffx-2wm9). The 2026-07-21 fix re-validated the service lifecycle under serviceResponseDataStoreLock but reused an already-captured, now stale reporter pointer and never re-validated the server, and that lock does not guard ServerShared. An authenticated user with the member role who owns an agent can issue a concurrent server delete (POST /api/v1/batch-delete/server) for their own server to win the race window, causing the worker to dereference a missing entry in the server list snapshot. Because the sentinel workers and the gRPC server have no recover()/recovery interceptor, the resulting panic is unrecovered and crashes the entire instance. This is fixed in version 2.3.1.
Published: 2026-09-27
Score: 6 Medium
EPSS: n/a
KEV: No
Impact: Denial of Service
Action: Patch
AI Analysis

Impact

Ineffective guard around the sentinel worker leads to a nil dereference when a concurrent server delete attempts to access a stale reporter pointer. The resulting unrecovered panic crashes the entire Nezha instance, causing a denial of service for all monitored services and dashboards.

Affected Systems

Nezha versions 2.2.11 through 2.3.0 are affected. An authenticated user with a member role who owns an agent can issue a POST /api/v1/batch-delete/server request for their own server, triggering the race condition.

Risk and Exploitability

The CVSS score of 6 indicates moderate severity. EPSS data is unavailable and the vulnerability is not listed in CISA KEV, so exploitation likelihood is uncertain, but any successful exploit immediately brings the entire instance offline, disrupting service availability.

Generated by OpenCVE AI on September 27, 2026 at 22:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade Nezha to version 2.3.1 or later.
  • If an upgrade is not feasible, disable the batch‑delete endpoint or remove member‑role privileges until the fix is applied.
  • Monitor the system for crash logs or unexplained panics to detect any exploitation attempts.

Generated by OpenCVE AI on September 27, 2026 at 22:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sun, 27 Sep 2026 21:00:00 +0000

Type Values Removed Values Added
Description Nezha is a server and website monitoring tool. In versions >= 2.2.11 and < 2.3.1, the service sentinel worker (service/singleton/servicesentinel.go) contains an incomplete fix for a previously reported nil dereference denial of service (GHSA-qjpp-gffx-2wm9). The 2026-07-21 fix re-validated the service lifecycle under serviceResponseDataStoreLock but reused an already-captured, now stale reporter pointer and never re-validated the server, and that lock does not guard ServerShared. An authenticated user with the member role who owns an agent can issue a concurrent server delete (POST /api/v1/batch-delete/server) for their own server to win the race window, causing the worker to dereference a missing entry in the server list snapshot. Because the sentinel workers and the gRPC server have no recover()/recovery interceptor, the resulting panic is unrecovered and crashes the entire instance. This is fixed in version 2.3.1.
Title Nezha before 2.3.1 Denial of Service via Concurrent Server Delete
Weaknesses CWE-367
References
Metrics cvssV3_1

{'score': 5.3, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 6, 'vector': 'CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

No data.

cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-09-27T20:49:59.487Z

Reserved: 2026-09-27T20:29:07.432Z

Link: CVE-2026-101088

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-09-27T21:17:02.727

Modified: 2026-09-27T21:17:02.727

Link: CVE-2026-101088

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-09-27T22:30:17Z

Weaknesses
  • CWE-367

    Time-of-check Time-of-use (TOCTOU) Race Condition