Quick answers
- Is CVE-2026-83599 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-83599 being exploited in the wild.
- How severe is CVE-2026-83599?
- High severity, with a CVSS score of 7.5, published 22 September 2026.
- Which products and versions are affected?
- Netdata before 2.11.0.
- Is there a fix for CVE-2026-83599?
- A patch was published on 2026-06-29: Fix committed to master branch before public disclosure Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-83599 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-83599?
- Check whether you run Netdata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is a decompression bomb attack (CWE-409) in the WebSocket server's permessage-deflate handler. The websocket_client_decompress_message() function allows decompressed output to grow up to WS_MAX_DECOMPRESSED_SIZE without enforcing a compressed-to-decompressed ratio limit, enabling small payloads to expand into large allocations. An unauthenticated remote attacker can trigger memory exhaustion via concurrent WebSocket connections with malicious compressed frames.
Affected products
- Netdata Netdata before 2.11.0
Timeline
- 2026-09-22: disclosed
- 2026-06-29: patched: Fix committed to master branch before public disclosure