CVE-2026-120046

MediumCVSS 5.3/10Last modified Nov 5, 2026

Description

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned service_histories rows that crash the non-TSDB dashboard on its next startup until removed manually.

Metrics

CVSS 3.1 5.3/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-476

Affected software

Vendor	Product	Versions
nezhahq	nezha	>= 2.0.0, < 2.4.0

References

Timeline

Published: Oct 30, 2026
Last modified: Nov 5, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-120057.2IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container CVE-2026-1200577.5psqlODBC copies the reply to a large-object read (loread) into the application's buffer using the length sent by the server, without compari CVE-2026-1200587.5psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply w CVE-2026-1200596.8For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by CVE-2026-1200605.9psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction CVE-2026-1200617.5The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a {fn} escape into a fixed 16-entry sta CVE-2026-1200627.5SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other c CVE-2026-1200635.9When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the CVE-2026-1200647.5Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol wit CVE-2026-1200657.1For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It pla CVE-2026-1200665.3On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, an CVE-2026-1200675.9For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copie