Nezha 2.0.0 before 2.4.0 Startup NULL Pointer Dereference via Orphaned Service History
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 2.4.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Nezha, a self-hosted server monitoring dashboard, is affected in versions from 2.0.0 up to (but not including) 2.4.0. An authenticated user can delete a service they created, which leaves behind orphaned history records that cause the dashboard to crash on its next startup until an administrator removes them manually.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- nezhahq nezha
From 2.0.0 · fixed in 2.4.0