CVE-2026-105112: Nezha 1.8.0 before 2.3.13 Deadlock DoS via notification-group endpoints
Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Nezhato a version that resolves this vulnerability.Fixed in 2.3.13
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Nezha versions from 1.8.0 through versions before 2.3.13 are affected. Exploitation targets the alerting subsystem, where it can stop alert delivery until the service is restarted.
What access does an attacker need?
An attacker needs an authenticated non-admin account. They must concurrently invoke notification-group update activity and batch-delete requests, using oversized ID lists to increase the race window.
Are confidentiality or integrity impacts indicated?
The provided impact vector indicates no confidentiality or integrity impact. The consequence is an availability failure: alert delivery can be permanently halted until restart.
What can be done if an immediate upgrade is not possible?
Limit access to the notification-group and batch-delete endpoints to trusted users, and avoid allowing oversized batch ID lists where possible. If the deadlock occurs, restarting the affected service restores alert delivery.