high7.5
CVE-2026-83599
Netdata is an open source observability tool.
Impact
Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow decompressed output toward WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio. Small highly compressed frames can therefore cause large server-side allocations, and repeated concurrent connections can exhaust memory and terminate monitoring. This vulnerability is fixed in 2.11.0.
Affected products
| Product | Affected versions |
|---|---|
| Netdata Is An Open Source Observability Tool. | before 2.11.0 |
Versions were read from the advisory text. No structured product data has been published for this record yet.