CVE-2026-100394 Details
Description
Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From 2.2.7 until 2.2.11, ServiceSentinel.worker in service/singleton/servicesentinel.go checked an owned service under servicesLock and later dereferenced pointer-valued serviceStatusToday and serviceCurrentStatusData entries under serviceResponseDataStoreLock without revalidating that ServiceSentinel.Delete had not removed them. A RoleMember could concurrently report TCP or ICMP results through the member's own agent and delete the same owned service, causing a nil pointer dereference. Because the gRPC server had no recovery interceptor, the worker panic terminated the whole dashboard process and disrupted every tenant's web interface, REST API, and agent connections. The issue affects availability only and does not disclose or modify data. This issue is fixed in versions 2.2.11 and 2.3.0.
A denial-of-service vulnerability has been identified in Nezha Monitoring versions 2.2.7 prior to 2.2.11. The issue arises in the ServiceSentinel.worker function, where a nil pointer dereference occurs. This happens because the worker checks the status of a service under one lock and later accesses pointer-valued data under a different lock, without revalidating that the service has not been deleted. A RoleMember can exploit this by concurrently reporting results through their agent while deleting the same service, causing a crash that disrupts the entire dashboard process. The vulnerability impacts availability by terminating the dashboard process, which affects all tenants' web interfaces, REST APIs, and agent connections.
Users are advised to upgrade to Nezha Monitoring versions 2.2.11 or 2.3.0, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Oct 14, 2026CISA-ADP
Assessed Oct 29, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/nezhahq/nezha/security/advisories/GHSA-qjpp-gffx-2wm9 | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/nezhahq/nezha/commit/c893aa57867d8a3d608e2f2f16d1594c9766cdf3 | [email protected] | Source CodeVendor |
| https://github.com/nezhahq/nezha/releases/tag/v2.2.11 | [email protected] | Release NotesVendor |
| https://github.com/nezhahq/nezha/releases/tag/v2.3.0 | [email protected] | Release NotesVendor |
| https://github.com/nezhahq/nezha/security/advisories/GHSA-qjpp-gffx-2wm9 | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-362 | Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') | [email protected] |
| CWE-476 | NULL Pointer Dereference | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Nezha Monitoring | >= 2.2.7, < 2.2.11 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Oct 29, 2026 | CVE Modified | CISA-ADP |
| Oct 14, 2026 | New CVE Received | [email protected] |