Description
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
Published: 2026-10-16
Score: 7.1 High
EPSS: < 1% Very Low
KEV: No
Impact: Denial of Service via Resource Exhaustion
Action: Patch Upgrade
AI Analysis

Impact

Authenticated users can open unlimited concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Each connection creates a ServerTransferClass.Subscribe instance that consumes file descriptors, memory, and goroutines, eventually exhausting system resources and blocking agent gRPC reconnections. This flaw is a classic resource exhaustion vulnerability (CWE‑770) that can bring the monitored agents or the Nezha server to a halt.

Affected Systems

Nezha 2.0.13 through 2.3.14 deployed via the nezhahq:nezha product line. Any instance of these versions that has the /api/v1/ws/transfer endpoint exposed is vulnerable.

Risk and Exploitability

The CVSS score of 7.1 indicates moderate‑to‑high severity and the EPSS score is 0.295% (0.00295), indicating a very low exploitation probability. The flaw is not listed in the CISA KEV catalog. Attackers must authenticate to Nezha and can perform the exploit from remote locations where the WebSocket endpoint is reachable. Even a single compromised user could exhaust critical resources, causing denial of service for the entire monitoring infrastructure.

Generated by OpenCVE AI on October 16, 2026 at 15:27 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Nezha to version 2.3.15 or later to apply the official fix
  • Limit the number of concurrent WebSocket connections or restrict this endpoint to only essential, trusted authenticated users
  • Configure operating‑system resource limits such as file descriptor quotas and goroutine caps to mitigate the impact of accidental or malicious overloads

Generated by OpenCVE AI on October 16, 2026 at 15:27 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Sat, 17 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Nezhahq
Nezhahq nezha
Vendors & Products Nezhahq
Nezhahq nezha

Fri, 16 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 16 Oct 2026 01:45:00 +0000

Type Values Removed Values Added
Description Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
Title Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
Weaknesses CWE-770
References
Metrics cvssV3_1

{'score': 6.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

cvssV4_0

{'score': 7.1, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N'}

Subscriptions

Nezhahq Nezha
cve-icon MITRE

Status: PUBLISHED

Assigner: VulnCheck

Published:

Updated: 2026-10-16T16:24:21.877Z

Reserved: 2026-10-15T21:55:44.537Z

Link: CVE-2026-111383

cve-icon Vulnrichment

Updated: 2026-10-16T16:24:16.611Z

cve-icon NVD

Status : Deferred

Published: 2026-10-16T03:18:05.537

Modified: 2026-10-16T17:17:33.160

Link: CVE-2026-111383

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-17T14:15:09Z

Weaknesses
  • CWE-770

    Allocation of Resources Without Limits or Throttling