CVE-2026-111383
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Oct 16, 2026
Vendor
unknown
Description
Nezha from 2.0.13 before 2.3.15 contains a resource exhaustion vulnerability that allows authenticated users to open unbounded concurrent connections to the /api/v1/ws/transfer WebSocket endpoint. Attackers can hold thousands of subscriptions created by ServerTransferClass.Subscribe without limits, exhausting file descriptors, memory, and goroutines and blocking agent gRPC reconnections.