medium6.5
CVE-2026-111383
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /a…
Impact
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
Affected products
| Product | Affected versions |
|---|---|
| Nezha From 2.0.13 | before 2.3.15 |
Versions were read from the advisory text. No structured product data has been published for this record yet.