{"id":"EUVD-2026-36601","enisaUuid":"d91c46c9-8d95-302d-a8c7-71d01a627c8b","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: POST /api/v1/terminal → createTerminal() (terminal.go:27-67) and POST /api/v1/file → createFM() (fm.go:28-67). Both call rpc.NezhaHandlerSingleton.CreateStream(streamId, ...) which inserts a new ioStreamContext into an unbounded map[string]*ioStreamContext (s.ioStreams in io_stream.go:59-67). There is no per-user rate limit, no global semaphore, and no per-server connection cap. This issue has been patched in version 2.2.0.","datePublished":"Jun 12, 2026, 9:04:38 PM","dateUpdated":"Jun 15, 2026, 7:27:20 PM","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq\n","aliases":"CVE-2026-53522\nGHSA-jg62-j5h6-8mpq\n","assigner":"GitHub_M","epss":0.35,"enisaIdProduct":[{"id":"3b48ee14-6cbc-3adb-936d-dd19577528e7","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.0.0, \u003c 2.2.0"}],"enisaIdVendor":[{"id":"b7cc9cc6-893b-3b6a-bef2-706cfa4276a6","vendor":{"name":"nezhahq"}}],"enisaIdVulnerability":[{"id":"b0b6aea4-9854-36e2-a79f-42c715427ff1","vulnerability":{"id":"CVE-2026-53522","description":"Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O\u0026M tool. From version 1.0.0 to before version 2.2.0, the Nezha dashboard exposes two endpoints that create long-lived WebSocket streams to monitored agents: POST /api/v1/terminal → createTerminal() (terminal.go:27-67) and POST /api/v1/file → createFM() (fm.go:28-67). Both call rpc.NezhaHandlerSingleton.CreateStream(streamId, ...) which inserts a new ioStreamContext into an unbounded map[string]*ioStreamContext (s.ioStreams in io_stream.go:59-67). There is no per-user rate limit, no global semaphore, and no per-server connection cap. This issue has been patched in version 2.2.0.","datePublished":"Jun 12, 2026, 9:04:38 PM","dateUpdated":"Jun 15, 2026, 7:27:20 PM","status":"PUBLISHED","baseScore":6.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq\n","enisa_id":"EUVD-2026-36601\n","assigner":"GitHub_M","epss":0.35,"dataProcessed":"Oct 28, 2026, 7:16:16 AM","vulnerabilityProduct":[{"id":"01730bed-7e91-3c05-b5cf-f00b452d47ae","product":{"name":"nezha","vendor":{"name":"nezhahq"}},"product_version":"1.0.0, \u003c 2.2.0"}],"vulnerabilityVendor":[{"id":"f1eccc1e-02e3-3a31-b2b9-637b2e929173","vendor":{"name":"nezhahq"}}]}},{"id":"c77842c1-793a-3e45-ad5d-2734633fcd37","vulnerability":{"id":"GHSA-jg62-j5h6-8mpq","description":"Nezha Monitoring: Unbounded WebSocket Streams — Resource Exhaustion DoS","datePublished":"Jun 26, 2026, 11:04:18 PM","dateUpdated":"Jun 26, 2026, 11:04:18 PM","baseScore":0.0,"references":"https://github.com/nezhahq/nezha/security/advisories/GHSA-jg62-j5h6-8mpq\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-53522\nhttps://github.com/nezhahq/nezha\n","enisa_id":"EUVD-2026-36601\n","aliases":"GHSA-jg62-j5h6-8mpq\nCVE-2026-53522\n","epss":0.0,"dataProcessed":"Oct 25, 2026, 1:57:08 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}}],"enisaIdAdvisory":[]}