CVE-2026-105112 nezhahq CVE debrief

Who should care

Defenders and administrators using Nezha versions 1.8.0 before 2.3.13 should assess their exposure and potential impact. They should prioritize verifying system versions, restricting access to vulnerable endpoints, and considering upgrades to fixed versions. This vulnerability may impact alerting and monitoring systems, necessitating prompt review and mitigation. Operators, platform administrators, and security teams need to coordinate on exposure review,

Why it matters

CVE-2026-105112 is a medium-severity vulnerability in Nezha that allows authenticated non-admin users to potentially deadlock the alerting subsystem. Defenders should prioritize verifying exposure, assessing potential impact, and considering upgrades to affected systems.

• Potential permanent killing of alert delivery until restart
• Possible impact on monitoring and alerting systems
• Requires verification of exposure and potential impact
• May necessitate upgrading to Nezha version 2.3.13 or later

Technical summary

The vulnerability is caused by a lock-order inversion in the UpdateGroup and DeleteGroup functions of Nezha versions 1.8.0 before 2.3.13. An attacker can exploit this by concurrently calling the notification-group and batch-delete endpoints with oversized ID lists, potentially causing a deadlock in the alerting subsystem. This issue can lead to permanent killing of alert delivery until a restart. Technical details indicate a need for defenders to focus on restricting access and monitoring systems for anomalies. Source-grounded technical framing emphasizes verifying exposure and assessing potential impact.

Defensive priority

Defenders should prioritize verifying exposure and assessing potential impact, especially in environments using affected Nezha versions.

Recommended defensive actions

• Verify Nezha version and assess exposure
• Restrict access to notification-group and batch-delete endpoints
• Monitor alerting subsystem for potential deadlocks
• Consider upgrading to Nezha version 2.3.13 or later
• Review compensating controls for exposed systems
• Track exceptions and retest remediated assets
• Check relevant monitoring, detection, and logs for exposed assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, but additional information from vendor sources may be necessary for comprehensive risk assessment. Grounding in source-provided details, evidence limits, and known affected scope is crucial. Defenders should verify exposure, review official advisories, and consider compensating controls. Limited source detail suggests cautious validation of vendor claims and affected system inventories.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.