CVE-2026-101085

6.5 MEDIUMpublic exploit available

Published 2026-09-27 · Updated 2026-09-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint to crash the dashboard process, which persists the rule and causes repeated crashes on restart, disabling all monitoring and control plane functionality.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-197

Public exploit & PoC references

https://github.com/nezhahq/nezha/security/advisories/GHSA-2qc6-x993-hjq9
https://github.com/nezhahq/nezha/security/advisories/GHSA-2qc6-x993-hjq9

All references

https://github.com/nezhahq/nezha/security/advisories/GHSA-2qc6-x993-hjq9
https://www.vulncheck.com/advisories/nezha-before-2.3.8-denial-of-service-via-alert-rule
https://github.com/nezhahq/nezha/security/advisories/GHSA-2qc6-x993-hjq9

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2026-19667
LOWCVE-2026-63449PoC
UNSCOREDCVE-2026-76151
HIGHCVE-2026-96280PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.