CVE-2026-111384
CVE-2026-111384 · Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket
Cette page présente des faits issus de sources publiques. Consultez l’avis original avant toute mise à jour.
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
CVSS 7.1 · Élevée · EPSS 0,4% · Correctif disponible
- Publication
- Mise à jour
Produits et versions concernés
nezha
- Versions du logiciel
- ≥ 1.0.0, < 2.3.15: Concernée (semver)
- 2.3.15: Non concernée (semver)
Mettez à jour vers 2.3.15
Sources originales
- https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9
- https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
- https://www.vulncheck.com/advisories/nezha-1.0.0-before-2.3.15-memory-exhaustion-via-file-manager-websocket
- https://nvd.nist.gov/vuln/detail/CVE-2026-111384