CVE-2026-83599

Name of the Vulnerable Software and Affected Versions Netdata versions prior to 2.11.0

Description The unauthenticated WebSocket server negotiates permessage-deflate before authentication. In the file src/web/websocket/websocket-compression.c, the function websocket client decompress message() allows decompressed output to grow toward WS MAX DECOMPRESSED SIZE without enforcing a compressed-to-decompressed ratio. This allows small, highly compressed frames to trigger large server-side memory allocations. Repeated concurrent connections can lead to memory exhaustion and the termination of monitoring services.

Recommendations Update to version 2.11.0.