CVE-2026-111384

6.5 MEDIUMpublic exploit available

Published 2026-10-16 · Updated 2026-10-16

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses

CWE-770

Public exploit & PoC references

https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9

All references

https://github.com/nezhahq/nezha/commit/36b742a7e9a81ed782363dd19efd77b7030fbd0f
https://github.com/nezhahq/nezha/security/advisories/GHSA-7242-982f-83p9
https://www.vulncheck.com/advisories/nezha-1.0.0-before-2.3.15-memory-exhaustion-via-file-manager-websocket

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

HIGHCVE-2023-54404PoC
MEDIUMCVE-2025-12767
UNSCOREDCVE-2025-8352
MEDIUMCVE-2026-100274
MEDIUMCVE-2026-100350PoC
MEDIUMCVE-2026-100508
MEDIUMCVE-2026-100600PoC
LOWCVE-2026-100649PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.