Netdata EUVD-2026-84561

Exploitation requires network reachability to a pre-2.11.0 Netdata instance's WebSocket server (default web listener on 0.0.0.0:19999) where the client can negotiate the permessage-deflate extension - which the server offers BEFORE authentication, so no credentials are needed. No user interaction or special victim-side setup is required. Limiting factors: the Netdata WebSocket/web interface must be network-exposed to the attacker (instances bound to localhost or firewalled/reverse-proxied with connection limits are not reachable), and only versions prior to 2.11.0 lack the compression-ratio guard. Impact is confined to availability of the monitoring service (memory exhaustion / process termination); no data is read or modified.

This is a legitimate availability risk despite being 'only' a DoS. The CVSS vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5) indicates a fully remote, unauthenticated, low-complexity attack with no user interaction and pure availability impact - consistent with CWE-409 (Improper Handling of Highly Compressed Data). The description and the PR diff corroborate this: permessage-deflate is negotiated BEFORE authentication, and the pre-fix decompressor lacked any compressed-to-decompressed ratio guard, so a ~100-byte frame can drive allocation toward the 200MB WS_MAX_DECOMPRESSED_SIZE ceiling; concurrent connections multiply this into memory exhaustion that terminates monitoring. No EPSS, KEV, or POC data was provided, so exploitation likelihood cannot be quantified from these signals - but the attack is trivial to script and the source-level root cause is public via the fix commit and advisory, which lowers the practical barrier. SSVC framing: exploitation=none observed (no KEV/POC in input), automatable=yes (repeatable network requests, no per-target work), technical impact=partial (availability of the monitoring service only, no code exec or data exposure). Net: a real, easily-triggered availability priority for internet-exposed Netdata, but not a confidentiality/integrity emergency. The 'Information Disclosure' tag conflicts with the CVSS vector (C:N) and the CWE - treat the tag as wrong, not the vector.

An attacker who can reach a pre-2.11.0 Netdata WebSocket endpoint opens a connection, and because permessage-deflate is negotiated before authentication, sends small highly-compressed frames (e.g., ~100 bytes of repeated bytes) that expand toward the 200MB decompression ceiling. Opening many concurrent connections and repeating this exhausts server memory and kills the monitoring process. No POC was identified in the provided data, but the technique is straightforward and the root cause is documented in the public fix.