CVE-2026-101085CWE-197

CVE-2026-101085

Medium · published September 28, 2026

CVSS v3.1
6.5
EPSS
0%
Percentile
15.3
In the wild
Unconfirmed
What it is

Nezha before 2.3.8 fails to validate alert rule type and duration bounds, allowing authenticated non-administrator users to create malformed rules that trigger unrecovered panics in the alert evaluator goroutine. Attackers can submit a crafted alert rule via the POST /api/v1/alert-rule endpoint to crash the dashboard process, which persists the rule and causes repeated crashes on restart, disabling all monitoring and control plane functionality.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
7.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
EPSS
0.00249 · 15.3th percentile
Weakness
CWE-197 · Numeric Truncation Error
Published
2026-09-28T01:17Z
References (3)
https://github.com/nezhahq/nezha/security/advisories/GHSA-2qc6-x993-hjq9 · [email protected]https://www.vulncheck.com/advisories/nezha-before-2.3.8-denial-of-service-via-alert-rule · [email protected]https://github.com/nezhahq/nezha/security/advisories/GHSA-2qc6-x993-hjq9 · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 29 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 27 SEP 20:49Z
    Nezha before 2.3.8 Denial of Service via Alert Rule
    cvelistv5