CVE-2026-111383 nezhahq CVE debrief

Who should care

Defenders responsible for systems using Nezha versions from 2.0.13 before 2.3.15 should assess exposure and prioritize mitigation to prevent potential denial of service. This includes verifying if the system uses affected versions of Nezha, implementing rate limiting or other controls, and monitoring system resources for signs of exhaustion. Security teams and operators managing these systems should review the vulnerability details and take appropriate to

Why it matters

CVE-2026-111383 is a resource exhaustion vulnerability in Nezha that allows authenticated users to cause a denial of service. Defenders should prioritize verifying exposure and assessing the impact on their systems, especially if they are using affected versions.

• Denial of service due to resource exhaustion
• Potential for system crashes or instability
• Need for verification of exposure and impact
• Priority for upgrading to a non-affected version of Nezha

Technical summary

The vulnerability allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint, causing a denial of service by exhausting file descriptors, memory, and goroutines. This issue arises from the lack of limits on subscriptions created by ServerTransferClass.Subscribe, leading to resource exhaustion and potential system instability. Defenders should prioritize verifying exposure and assessing the impact on their systems, especially if they are using affected versions of Nezha.

Defensive priority

Defenders should prioritize verifying exposure and assessing the impact of this vulnerability on their systems, especially if they are using affected versions of Nezha.

Recommended defensive actions

• Verify if the system uses affected versions of Nezha and assess exposure
• Implement rate limiting or other controls to prevent unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint
• Monitor system resources for signs of exhaustion and adjust configuration as needed
• Consider upgrading to a version of Nezha that is not affected by this vulnerability
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and NVD entry provide details about the vulnerability, but additional information from the vendor and other sources may be necessary to fully understand the impact and mitigate the vulnerability.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.