Description
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| nezhahq | nezha | 2.0.13 – < 2.3.15 | 2.3.15 |
References
- GitHub Security Advisory (GHSA-ch6h-w872-77mx) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: Nezha 2.0.13 before 2.3.15 Denial of Service via /api/v1/ws/transfer WebSocket third-party-advisory