Medium severity5.3NVD Advisory· Published Oct 3, 2026

CVE-2026-105112

Description

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Nezhahq/Nezhallm-fuzzy
Range: 1.8.0 - 2.3.13

Patches

Vulnerability mechanics

References

github.com/nezhahq/nezha/security/advisories/GHSA-53vr-p24v-qvwfnvd
www.vulncheck.com/advisories/nezha-1.8.0-before-2.3.13-deadlock-dos-via-notification-group-endpointsnvd

News mentions

No linked articles in our index yet.

cvss	0.345
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000