Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant

{
  "id": "12d36531c2db9629068f6ad7905da5c47cc5a79cafee45ebb03253be9896b0c7",
  "url": "https://osv.dev/vulnerability/GHSA-qjpp-gffx-2wm9",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant",
    "summary": "## Summary A single low-privilege `RoleMember` can take the entire Nezha dashboard offline, and with it every tenant's web UI, REST API, and agent connections, by racing two ordinary operations on their own service. The crash is a nil pointer dereference in the service-monitor worker at `service/singleton/servicesentinel.go:601`. The worker checks a service exists under one lock and later writes to two pointer-valued status maps under a different lock; a concurrent delete removes the entries in the gap. Because the gRPC server has no recovery interceptor, the worker-goroutine panic kills the whole process. Availability only: nothing is read or modified. ## Affected versions Confirmed in `v2.2.7` through `v2.2.10`. `service/singleton/servicesentinel.go` has the same vulnerable implementation in all four releases. The issue is fixed in `v2.2.11` and later; users should upgrade to the latest release, `v2.3.0`. ## The bug The worker validates an incoming report and later writes it to two status maps, but the check and the write are guarded by two different locks taken at two different times. Between them, the same member can delete the service and pull the map entries out from under the worker. The maps hold pointers, so a missing key returns nil and the first field write through it panics: ``` 73: serviceStatusToday map[uint64]*_TodayStatsOfService 74: serviceCurrentStatusData map[uint64]*serviceTaskStatus ``` The worker checks presence via `Get`, which takes `servicesLock` and ",
    "evidence": "osv:GHSA-qjpp-gffx-2wm9",
    "products": [
      {
        "name": {
          "value": "github.com/nezhahq/nezha",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260721131105-c893aa57867d",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "medium",
    "structured": {
      "id": "GHSA-qjpp-gffx-2wm9",
      "aliases": [
        "CVE-2026-100394",
        "GHSA-qjpp-gffx-2wm9",
        "GO-2026-6794"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0.0.0-20260628010923-fd31e5f1b0f8"
                },
                {
                  "fixed": "0.0.0-20260721131105-c893aa57867d"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/nezhahq/nezha",
            "purl": "pkg:golang/github.com/nezhahq/nezha",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/10/GHSA-qjpp-gffx-2wm9/GHSA-qjpp-gffx-2wm9.json"
          }
        }
      ],
      "modified": "2026-10-19T21:41:12.039280394Z",
      "provider": "osv",
      "references": [
        "https://github.com/nezhahq/nezha/security/advisories/GHSA-qjpp-gffx-2wm9",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100394",
        "https://github.com/nezhahq/nezha/commit/c893aa57867d8a3d608e2f2f16d1594c9766cdf3",
        "https://github.com/nezhahq/nezha",
        "https://github.com/nezhahq/nezha/releases/tag/v2.2.11",
        "https://github.com/nezhahq/nezha/releases/tag/v2.3.0"
      ],
      "provider_metadata": {
        "cwe_ids": [
          "CWE-362",
          "CWE-476"
        ],
        "severity": "MODERATE",
        "github_reviewed": true,
        "nvd_published_at": "2026-10-14T16:17:28Z",
        "github_reviewed_at": "2026-10-15T20:15:06Z"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-100394",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 376784,
  "published_at": "2026-10-15T20:15:06+00:00"
}

{
  "id": "ae4ef3dc21fa28aad4836a9b1b6aed674a24d2fba13904e1a6300998f374cd3b",
  "url": "https://osv.dev/vulnerability/GO-2026-6794",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha",
    "summary": "Nezha Monitoring: Whole-instance DoS in Nezha dashboard: a member can crash the process for every tenant in github.com/nezhahq/nezha",
    "evidence": "osv:GO-2026-6794",
    "products": [
      {
        "name": {
          "value": "github.com/nezhahq/nezha",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "0.0.0-20260721131105-c893aa57867d",
            "evidence": "/affected/0/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "GO-2026-6794",
      "aliases": [
        "CVE-2026-100394",
        "GHSA-qjpp-gffx-2wm9",
        "GO-2026-6794"
      ],
      "affected": [
        {
          "ranges": [
            {
              "type": "SEMVER",
              "events": [
                {
                  "introduced": "0.0.0-20260628010923-fd31e5f1b0f8"
                },
                {
                  "fixed": "0.0.0-20260721131105-c893aa57867d"
                }
              ]
            }
          ],
          "package": {
            "name": "github.com/nezhahq/nezha",
            "purl": "pkg:golang/github.com/nezhahq/nezha",
            "ecosystem": "Go"
          },
          "database_specific": {
            "source": "https://vuln.go.dev/ID/GO-2026-6794.json"
          },
          "ecosystem_specific": {}
        }
      ],
      "modified": "2026-10-19T21:31:38.307424732Z",
      "provider": "osv",
      "references": [
        "https://github.com/nezhahq/nezha/security/advisories/GHSA-qjpp-gffx-2wm9",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-100394",
        "https://github.com/nezhahq/nezha/commit/c893aa57867d8a3d608e2f2f16d1594c9766cdf3",
        "https://github.com/nezhahq/nezha/releases/tag/v2.2.11",
        "https://github.com/nezhahq/nezha/releases/tag/v2.3.0"
      ],
      "provider_metadata": {
        "url": "https://pkg.go.dev/vuln/GO-2026-6794",
        "review_status": "UNREVIEWED"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-100394",
        "evidence": "/aliases"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 376568,
  "published_at": "2026-10-19T21:08:35+00:00"
}