Description

Nezha from 1.8.0 before 2.3.13 contains a lock-order inversion in UpdateGroup and DeleteGroup that allows authenticated non-admin users to deadlock the alerting subsystem. Attackers can concurrently call the notification-group and batch-delete endpoints with oversized id lists to widen the race and close an ABBA cycle, permanently killing alert delivery until restart.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-10-03T14:16:37.677Z",
  "pubdate": "2026-10-03T14:16:37.677Z",
  "executiveSummary": "Nezha versions 1.8.0 through 2.3.12 are susceptible to a lock-order inversion vulnerability located within the alerting subsystem's management functions, specifically UpdateGroup and DeleteGroup.\nThis flaw allows authenticated non-admin users to induce a permanent deadlock condition, effectively halting the delivery of system alerts.\nThe vulnerability is characterized as an ABBA lock-order inversion, which occurs when concurrent processes attempt to acquire multiple mutexes in conflicting sequences.\nExploitation requires the attacker to possess authenticated access, enabling them to manipulate notification group states and trigger batch deletion operations simultaneously.\nBy submitting requests with oversized ID lists, an attacker can widen the race window, increasing the probability of a successful deadlock.\nThe impact is a complete denial-of-service (DoS) for the alerting mechanism, which persists until the application process is manually restarted.\nBecause the deadlock occurs at the system level, it presents a significant risk to operational monitoring integrity, as administrators may remain unaware of critical system events while the alert delivery system is incapacitated.",
  "technicalDetails": "The root cause of this vulnerability is an inconsistent locking hierarchy within the Nezha alerting subsystem. The functions UpdateGroup and DeleteGroup perform overlapping resource modifications that require the acquisition of multiple internal mutexes to maintain data consistency.\nA lock-order inversion (specifically an ABBA deadlock) arises because these functions do not implement a global, canonical ordering for lock acquisition. When multiple threads are initiated—one invoking UpdateGroup and another invoking DeleteGroup—it is possible for one thread to acquire Lock A and wait for Lock B, while the second thread acquires Lock B and waits for Lock A.\nThe exploitation process leverages the application's handling of notification group management. An authenticated user can interact with the notification-group and batch-delete endpoints to manipulate the alert state. By crafting requests with exceptionally large ID lists, the attacker artificially increases the duration of the execution context for these operations.\nThis extension of processing time widens the race condition window, making the timing mismatch between the competing threads significantly more likely to occur. Once the threads enter the cyclic wait state, neither can proceed, causing the alert subsystem thread pool to exhaust resources as it waits indefinitely for the held mutexes to be released.\nThe affected components are the functions responsible for managing group configurations, primarily within the codebase sections handling notification alerting logic. The versions confirmed to be vulnerable are those ranging from 1.8.0 to 2.3.12. Upgrading to version 2.3.13 or later is required to address the flaw.\nThe attack is characterized as a denial-of-service vector that does not require administrative privileges, merely authenticated access to the user interface or API. The post-exploitation state results in a complete suspension of alerting services, which is not self-healing; the deadlock requires a restart of the application process to clear the hung threads and restore monitoring functionality.\nThis vulnerability highlights a critical failure in concurrent synchronization, as the lack of atomicity or structured locking in high-concurrency alert management endpoints allows low-privileged users to disrupt core infrastructure operations."
}