CVE-2026-111384
Medium · 6.5CVSS
6.5
EPSS
0.4%
Published
Oct 16, 2026
CISA due date
—
The record
Nezha 1.0.0 before 2.3.15 contains a memory exhaustion vulnerability in the dashboard file manager WebSocket endpoint because fmStream never calls SetReadLimit, leaving message size unbounded. Authenticated users with file manager scopes can send one oversized binary message to /api/v1/ws/file/:id, triggering an OOM kill that drops all agent monitoring.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|
Related vulnerabilities
- CVE-2026-119699 WPGraphQL Smart Cache before 2.3.3 contains an uncontrolled resource consumption… CWE-770
- CVE-2026-119701 WPGraphQL before 2.24.1 contains a missing rate limiting vulnerability that allows… CWE-770
- CVE-2026-119036 Business::GoCardless versions before 1.01 for Perl allow memory exhaustion by flattening… CWE-770
- CVE-2026-116128 Starlet versions from 0.20 before 0.33 for Perl allow memory exhaustion via unbounded… CWE-770
- CVE-2026-107312 Allocation of Resources Without Limits or Throttling vulnerability in Drupal Examples for… CWE-770
- CVE-2026-119209 pypdf is a free and open-source pure-python PDF library. CWE-770
- CVE-2026-90991 IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to… CWE-770
- CVE-2026-119134 Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps… CWE-770