CVE-2026-83599: Netdata: WebSocket Decompression Bomb
Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocketclientdecompressmessage() to grow decompressed output toward WSMAXDECOMPRESSEDSIZE without enforcing a compressed-to-decompressed ratio. Small highly compressed frames can therefore cause large server-side allocations, and repeated concurrent connections can exhaust memory and terminate monitoring. This vulnerability is fixed in 2.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netdatato a version that resolves this vulnerability.Fixed in 2.11.0
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote client that can reach Netdata's WebSocket server can send crafted compressed WebSocket frames. No credentials or user interaction are required.
What is the operational impact of a successful attack?
Small, highly compressed frames can trigger large server-side memory allocations. Repeated concurrent connections can exhaust memory and terminate monitoring.
Are installations running the default WebSocket behavior affected?
The affected behavior is the unauthenticated WebSocket server negotiating permessage-deflate before authentication. The provided data does not state whether this is enabled in every default deployment.
What remediation is available?
Upgrade Netdata to version 2.11.0, which fixes the vulnerability.