MEDIUM 6.0 NVD
CVE-2026-120046
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashbo
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
References
- https://github.com/nezhahq/nezha
- https://github.com/nezhahq/nezha/blob/9881c47f0cc92256ba203919da5a25fab79a6bad/cmd/dashboa
- https://github.com/nezhahq/nezha/blob/9881c47f0cc92256ba203919da5a25fab79a6bad/service/sin
- https://github.com/nezhahq/nezha/commit/efd3e07b901d6acf7ef2ab3b26458cc07e7605dc
- https://github.com/nezhahq/nezha/releases/tag/v2.4.0
This medium severity vulnerability with a CVSS score of 6.0 was published on 2026-10-30 via NVD.
vulnfeed aggregates 17712 vulnerabilities from NVD, CISA KEV,
Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.