CVE-2026-105112— Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints
Quick assessment
Affected
nezhahq nezha
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
哪吒（Nezha）1.8.0 至 2.3.13 版本（不含 2.3.13）中存在一个锁顺序倒置（lock-order inversion）漏洞，位于 和 函数中。该漏洞允许经过认证的、非管理员用户导致告警子系统死锁。攻击者可以通过并发调用通知组（notification-group）和批量删除（batch-delete）接口，并传入过大的 ID 列表来扩大竞态条件窗口，从而闭合 ABBA 锁循环，导致告警消息发送永久中断，直至系统重启。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-105112
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints
Source: CVE Program / CVE List V5
Vulnerability Description
Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
使用共享资源的并发执行不恰当同步问题(竞争条件)
Source: CVE Program / CVE List V5
Affected Products
II. Public POCs for CVE-2026-105112
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-105112
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-105112 (2)
IV. Related Vulnerabilities
Same product: nezha
-
CVE-2026-105113
Nezha 1.8.0 before 2.3.13 Denial of Service via Notification -
CVE-2026-101090
Nezha through 2.2.3 Host Header Injection via OAuth2 redirec -
CVE-2026-101089
Nezha before 2.2.7 Information Disclosure via /api/v1/profil -
CVE-2026-101087
Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 -
CVE-2026-101088
Nezha before 2.3.1 Denial of Service via Concurrent Server D
Same vendor: nezhahq
-
CVE-2026-105113
Nezha 1.8.0 before 2.3.13 Denial of Service via Notification -
CVE-2026-101090
Nezha through 2.2.3 Host Header Injection via OAuth2 redirec -
CVE-2026-101089
Nezha before 2.2.7 Information Disclosure via /api/v1/profil -
CVE-2026-101087
Nezha 2.0.10 through 2.3.2 SSRF Denylist Bypass IPv6 -
CVE-2026-101088
Nezha before 2.3.1 Denial of Service via Concurrent Server D
Same weakness: CWE-362
-
CVE-2026-104855
Wasmtime: Preemption and traps during bulk operations enable -
CVE-2026-39601
WordPress Booking Calendar plugin <= 11.8.4 - Race Condition -
CVE-2026-104057
Podgrab Unauthenticated DoS via Concurrent Map Access in Web -
CVE-2026-103282
Ghost 0.5.0 before 6.23.0 Multiple Account Creation via Invi -
CVE-2026-103651
MISP HOTP Token Replay via Stale Session-Cached Counter Allo
V. Comments for CVE-2026-105112
No comments yet