MEDIUM 6.0 NVD
CVE-2026-105112
Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting
Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.
References
- https://github.com/nezhahq/nezha/security/advisories/GHSA-53vr-p24v-qvwf
- https://www.vulncheck.com/advisories/nezha-1.8.0-before-2.3.13-deadlock-dos-via-notificati
This medium severity vulnerability with a CVSS score of 6.0 was published on 2026-10-03 via NVD.
vulnfeed aggregates 10650 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.