Description (CNA)
Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| nezhahq / nezha | affected 1.8.0 before 2.3.13; unaffected 2.3.13 |
CWE
CWE-362
References
- https://github.com/nezhahq/nezha/security/advisories/GHSA-53vr-p24v-qvwf
- https://www.vulncheck.com/advisories/nezha-1.8.0-before-2.3.13-deadlock-dos-via-notification-group-endpoints
ADP enrichment
No English description supplied.