CVE-2026-101085— Nezha before 2.3.8 Denial of Service via Alert Rule
Quick assessment
Affected
nezhahq nezha
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
哪吒（Nezha）在版本 2.3.8 之前存在验证缺陷，未对告警规则的类型和持续时间边界进行校验，导致已认证的非管理员用户可以构造畸形规则，使告警评估器协程（goroutine）触发无法恢复的恐慌（panic）错误。攻击者可通过向 接口提交精心构造的告警规则，导致仪表板进程崩溃。此类崩溃规则会被持久化存储，并在服务重启时反复引发崩溃，从而造成所有监控和控制平面功能的瘫痪。
Possible ATT&CK Techniques 2 AI
T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-101085
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nezha before 2.3.8 Denial of Service via Alert Rule
Source: CVE Program / CVE List V5
Vulnerability Description
Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint to crash the dashboard process, which persists the rule and causes repeated crashes on restart, disabling all monitoring and control plane functionality.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
数值截断错误
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-101085
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-101085
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-101085 (1)
-
🔗 Nezha before 2.3.8 Denial of Service via Alert Rule | Advisories | VulnCheck third-party-advisory
Other References for CVE-2026-101085 (1)
Same Patch Batch · nezhahq · 2026-09-27 · 6 CVEs total
| CVE-2026-101090 | 9.8 CRITICAL | Nezha through 2.2.3 Host Header Injection via OAuth2 redirect_uri |
| CVE-2026-101086 | 6.5 MEDIUM | Nezha Dashboard before 2.3.5 Task Type Validation Bypass |
| CVE-2026-101088 | 5.3 MEDIUM | Nezha before 2.3.1 Denial of Service via Concurrent Server Delete |
| CVE-2026-101087 | 4.3 MEDIUM | Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 |
| CVE-2026-101089 | 3.1 LOW | Nezha before 2.2.7 Information Disclosure via /api/v1/profile |
IV. Related Vulnerabilities
Same product: nezha
-
CVE-2026-101090
Nezha through 2.2.3 Host Header Injection via OAuth2 redirec -
CVE-2026-101089
Nezha before 2.2.7 Information Disclosure via /api/v1/profil -
CVE-2026-101087
Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 -
CVE-2026-101088
Nezha before 2.3.1 Denial of Service via Concurrent Server D -
CVE-2026-101086
Nezha Dashboard before 2.3.5 Task Type Validation Bypass
Same vendor: nezhahq
-
CVE-2026-101090
Nezha through 2.2.3 Host Header Injection via OAuth2 redirec -
CVE-2026-101089
Nezha before 2.2.7 Information Disclosure via /api/v1/profil -
CVE-2026-101087
Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 -
CVE-2026-101088
Nezha before 2.3.1 Denial of Service via Concurrent Server D -
CVE-2026-101086
Nezha Dashboard before 2.3.5 Task Type Validation Bypass
Same weakness: CWE-197
-
CVE-2026-96280
Flatpak: flatpak: buffer overflow in oci delta stream path n -
CVE-2026-63449
Suricata sip: large SIP message bodies can evade detection w -
CVE-2026-19667
Remote assertion failure via 16-bit length truncation in `dn -
CVE-2026-87529
Google Chrome 数字错误漏洞 -
CVE-2026-78512
Microsoft Office Word Remote Code Execution Vulnerability
V. Comments for CVE-2026-101085
No comments yet