CVE-2026-100394

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-100394
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100394.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-100394
Aliases
Published
2026-10-14T15:38:47Z
Modified
2026-10-16T02:47:27Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant
Details

Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-362",
        "CWE-476"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/100xxx/CVE-2026-100394.json"
}
References

Affected packages

Git / github.com/nezhahq/nezha

Affected ranges

Type
GIT
Repo
https://github.com/nezhahq/nezha
Events
Introduced
fd31e5f1b0f8f17cfe1cd68fc4ae1e8d0e852c7e
Fixed
c893aa57867d8a3d608e2f2f16d1594c9766cdf3
Fixed
5d7e8b58af927abd9a1e7381c1269c9f2256eae1
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "2.2.7"
        },
        {
            "fixed":  "2.2.11"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

v2.*
v2.2.10
v2.2.7
v2.2.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-100394.json"