Skip to content
Fencer Vulns
medium 6.5

CVE-2026-100394 json

Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

published 2026-10-14 25 d ago modified 2026-10-29 10 d ago also GHSA-qjpp-gffx-2wm9 , GO-2026-6794 , EUVD-2026-101303

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 42%
public exploits
0
none known

Summary

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.

Patch / fix

  • go github.com/nezhahq/nezha 0.0.0-20260721131105-c893aa57867d

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
partial
Assessed
10 d ago

Exploit prediction

0.50% chance of exploitation in the next 30 days, higher than 42% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/nezhahq/nezha/security/advisories/GHSA-qjpp-gffx-2wm9 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/nezhahq/nezha
>=0.0.0-20260628010923-fd31e5f1b0f8, <0.0.0-20260721131105-c893aa57867d
0.0.0-20260721131105-c893aa57867d

Affected products

  • nezhahq nezha

Classification

Weakness
  • CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization
  • CWE-476 NULL Pointer Dereference

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.