Executive brief
Netdata is an open source monitoring and observability platform used to track system and application performance. An unauthenticated attacker can send highly compressed WebSocket messages that decompress to very large sizes, forcing the server to allocate excessive memory. Repeated attacks from multiple connections can exhaust available memory and crash the monitoring service, causing loss of visibility into system health.
Technical details
The vulnerability is a decompression bomb attack (CWE-409) in the WebSocket server's permessage-deflate handler. The websocket_client_decompress_message() function allows decompressed output to grow up to WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio limit, enabling small payloads to expand into large allocations. An unauthenticated remote attacker can trigger memory exhaustion via concurrent WebSocket connections with malicious compressed frames.
Affected products
- Netdata Netdata before 2.11.0
Timeline
- 2026-09-22: disclosed
- 2026-06-29: patched: Fix committed to master branch before public disclosure