CVE-2026-83599

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-83599
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-83599.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-83599
Aliases
  • GHSA-c8p4-cg3j-f4h2
Downstream
Published
2026-09-22T16:54:56Z
Modified
2026-09-25T08:24:15Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Netdata: WebSocket Decompression Bomb
Details

Netdata is an open source observability tool. Prior to 2.11.0, Netdata's unauthenticated WebSocket server negotiates permessage-deflate before authentication, and src/web/websocket/websocket-compression.c allows websocket_client_decompress_message() to grow decompressed output toward WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio. Small highly compressed frames can therefore cause large server-side allocations, and repeated concurrent connections can exhaust memory and terminate monitoring. This vulnerability is fixed in 2.11.0.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-409"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83599.json"
}
References

Affected packages

Git / github.com/netdata/netdata

Affected ranges

Type
GIT
Repo
https://github.com/netdata/netdata
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
e3811f7ee6e9fdfc4cbcb9929cab3f5d71d722d7
Fixed
bb8f509e99cad230d3acc1fdfc840224f3b3db3a
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "2.11.0"
        }
    ],
    "source":  [
        "AFFECTED_FIELD",
        "REFERENCES"
    ]
}

Affected versions

1.*
1.32.1
1.34.0
Other
untagged-10d59b9e5fa68b9500e1
v0.*
v0.1
v0.2
v1.*
v1.0.0
v1.0rc
v1.1.0
v1.10.0
v1.11.0
v1.11.1
v1.12.0
v1.12.0-rc0
v1.12.0-rc1
v1.12.0-rc2
v1.12.0-rc3
v1.12.1
v1.12.2
v1.13.0
v1.14.0
v1.14.0-rc0
v1.15.0
v1.16.0
v1.16.1
v1.17.0
v1.17.1
v1.18.0
v1.18.1
v1.19.0
v1.2.0
v1.20.0
v1.21.0
v1.21.1
v1.22.0
v1.22.1
v1.23.0
v1.23.1
v1.23.1_infiniband
v1.23.2
v1.24.0
v1.25.0
v1.26.0
v1.27.0
v1.27.0_0104103941
v1.28.0
v1.29.0
v1.29.1
v1.29.2
v1.29.3
v1.3.0
v1.30.0
v1.30.1
v1.31.0
v1.32.0
v1.32.1
v1.33.0
v1.33.1
v1.34.0
v1.35.0
v1.36.0
v1.37.0
v1.38.0
v1.39.0
v1.4.0
v1.40.0
v1.41.0
v1.42.0
v1.43.0
v1.44.0
v1.45.0
v1.46.0
v1.47.0
v1.5.0
v1.6.0
v1.7.0
v1.8.0
v1.9.0
v1.99.0
v2.*
v2.0.0
v2.1.0
v2.10.0
v2.2.0
v2.3.0
v2.4.0
v2.5.0
v2.6.0
v2.7.0
v2.8.0
v2.9.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-83599.json"
vanir_signatures 
[
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "265748265580352707282139123011027359820",
            "length":  24955
        },
        "id":  "CVE-2026-83599-2b694dc0",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/netdata/netdata/commit/e3811f7ee6e9fdfc4cbcb9929cab3f5d71d722d7",
        "target":  {
            "file":  "src/daemon/main.c",
            "function":  "netdata_main"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "function_hash":  "319690513630453272128984189609985584917",
            "length":  3336
        },
        "id":  "CVE-2026-83599-6e4c796e",
        "signature_type":  "Function",
        "signature_version":  "v1",
        "source":  "https://github.com/netdata/netdata/commit/e3811f7ee6e9fdfc4cbcb9929cab3f5d71d722d7",
        "target":  {
            "file":  "src/web/websocket/websocket-compression.c",
            "function":  "websocket_client_decompress_message"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "237941781139394201097032130274482918485",
                "217109691937550721471913674388405318847",
                "314200889553597234755557431440070879907",
                "18205840008637397508096176493806080879",
                "57854819854922076175653623512928745598",
                "71982844128155026647763594494076009298",
                "38500932940866851381996473500127860447",
                "85133338535860877517440783071137718379",
                "291760115024937337632770677578613553094",
                "189379232150806154195232398370231473313",
                "48731520638862825127635868667406036727",
                "95199331122426593509826027837171127232",
                "286377881044021680748113821855885941111",
                "332785650821993707266447939812067344077",
                "258422623522411103466362660240113195529",
                "77519296803078219092104691526229295191",
                "33989095398251415062525636492370748073",
                "102975378717871889530464705625108976246",
                "190552325611250170157960099862695984341",
                "265689408574561318534080901615971148365"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-83599-f1e37a23",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/netdata/netdata/commit/e3811f7ee6e9fdfc4cbcb9929cab3f5d71d722d7",
        "target":  {
            "file":  "src/web/websocket/websocket-compression.c"
        }
    },
    {
        "deprecated":  false,
        "digest":  {
            "line_hashes":  [
                "3780881157807076732602137853564083079",
                "82228861357071341388272494790172383274",
                "336415399556279697232618298165823638456",
                "52365423174154809243751996652814351471",
                "125305090983745086340193817937445912150",
                "244072061751142293577501341132160869818",
                "219211534109713720422487329545831796157",
                "252714221018979057074190057171177272861",
                "291905062940095734005495828113079733508",
                "94805440365016489925259479700442877345",
                "27017677172705652581156469659548977627",
                "172273255344336553489874126708433811320"
            ],
            "threshold":  0.9
        },
        "id":  "CVE-2026-83599-f70eff65",
        "signature_type":  "Line",
        "signature_version":  "v1",
        "source":  "https://github.com/netdata/netdata/commit/e3811f7ee6e9fdfc4cbcb9929cab3f5d71d722d7",
        "target":  {
            "file":  "src/daemon/main.c"
        }
    }
]
vanir_signatures_modified 
"2026-09-25T08:24:15Z"