CVE-2026-83600

MEDIUM 6.5

Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

CWE	CWE-193 CWE-400
Vendor	netdata
Product	netdata
Published	Sep 22, 2026
Last Updated	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for netdata netdata

Be the first to know when new medium vulnerabilities affecting netdata netdata are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

netdata / netdata

< 2.10.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/netdata/netdata/security/advisories/GHSA-3mxw-fv2x-rhc6 github.com: https://github.com/netdata/netdata/pull/22598 github.com: https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b github.com: https://github.com/netdata/netdata/releases/tag/v2.10.4