CVE-2026-111383: Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An authenticated user can exploit it. The vulnerable endpoint is network-accessible at /api/v1/ws/transfer, so any user able to authenticate and reach that endpoint can create excessive concurrent WebSocket subscriptions.
What operational impact should be expected?
An attacker can retain thousands of subscriptions, exhausting file descriptors, memory, and goroutines. This can deny service and prevent agent gRPC reconnections.
Which versions are affected?
Nezha versions from 2.0.13 before 2.3.15 are affected. Version 2.3.15 and later are not identified as affected by the provided advisory information.