Nezha EUVD-2026-102564

Exploitation requires a valid authenticated session on the Nezha dashboard (CVSS PR:L) that can reach the /api/v1/ws/transfer WebSocket endpoint; no user interaction and no non-default configuration are needed beyond having a login-capable account. The concrete prerequisite is the ability to repeatedly establish WebSocket subscriptions via ServerTransferClass.Subscribe, which in vulnerable versions 2.0.13 through 2.3.14 are created without any per-user or global connection/subscription cap. Limiting factors for defenders: the attacker must already be authenticated (so exposure scales with how many and how trusted the dashboard accounts are, and whether self-registration is enabled), and impact is confined to availability of the dashboard and agent connectivity - no data exposure or code execution. Deployments that restrict dashboard access to a small set of trusted operators face substantially lower real-world risk.

This is a moderate-risk availability vulnerability, not a top-priority emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H) confirms a network-reachable, low-complexity attack but one that requires authentication (PR:L) and yields only availability impact - no confidentiality or integrity loss, and no scope change. There is no EPSS score, no CISA KEV listing, and no public exploit identified in the provided data, so there is no evidence of active or widespread exploitation; this is currently a theoretical-but-credible DoS reported by a reputable source (VulnCheck). The authentication requirement is the single most important mitigating factor: an attacker must already hold valid dashboard credentials, which in many self-hosted Nezha deployments means a trusted or low-privilege user rather than an anonymous internet attacker. The VA:H rating is justified because unbounded WebSocket subscriptions can exhaust file descriptors, memory, and goroutines and block agent gRPC reconnections, effectively taking the monitoring platform offline. Net: patch on a normal cadence; treat as elevated only if untrusted or self-registered accounts can reach the dashboard.

An authenticated (possibly low-privilege or self-registered) Nezha user scripts a client that repeatedly opens WebSocket connections to /api/v1/ws/transfer, each spawning a ServerTransferClass.Subscribe subscription that is never released. Within thousands of connections the dashboard exhausts file descriptors, memory, and goroutines, blocks agent gRPC reconnections, and becomes unavailable. No public exploit code was identified at time of analysis, but the attack is low-complexity and scriptable given valid credentials.