Description
Nezha Dashboard from 1.8.0 before 2.3.13 contains an improper locking vulnerability where a non-deferred mutex unlock leaks on a nil-map panic path. Any authenticated non-admin member can issue four notification API calls to permanently deadlock the alerting subsystem, then exhaust memory with blocking requests.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nezhahq | nezha | 1.8.0 – < 2.3.13 | 2.3.13 |
References
- GitHub Security Advisory (GHSA-7j7v-j77m-6g3m) vendor-advisory
- VulnCheck Advisory: Nezha 1.8.0 before 2.3.13 Denial of Service via Notification Mutex Deadlock third-party-advisory