CVE-2026-111384 HIGH

CVE-2026-111384: Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

Vendor Nezhahq

Product nezha

Weakness CWE-770 · Uncontrolled resource consumption

Published October 16, 2026

Last update October 16, 2026

View on NVD All CVEs

CVSS base score

7.1/10

Attack vector Network

Attack complexity Low

Privileges required Low

User interaction None

Confidentiality —

Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.

Key dates

02Disclosure timeline

October 16, 2026 CVE published

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2026-111384 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/770.html AskarLabs — CWE-770 write-up Allocation of Resources Without Limits or Throttling

Related vulnerabilities

CVE-2026-111384: Nezha 1.0.0 before 2.3.15 Memory Exhaustion via File Manager WebSocket

01Description

02Disclosure timeline

03References

04Related CVE