CVE-2026-83601

MEDIUM 6.5

Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write

CVSS Score

6.5

EPSS Score

0.0%

EPSS Percentile

0th

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot in src/plugins.d/pluginsd_internals.h without an upper bound. prd_array_create in src/database/rrdset-pluginsd-array.h can then wrap the size_t allocation calculation while retaining the original large array size, causing the subsequent initialization loop to write beyond the undersized heap allocation and crash the parent agent. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

CWE	CWE-190 CWE-787
Vendor	netdata
Product	netdata
Published	Sep 22, 2026

Stay Ahead of the Next One

Get instant alerts for netdata netdata

Be the first to know when new medium vulnerabilities affecting netdata netdata are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

netdata / netdata

< 2.10.4

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/netdata/netdata/security/advisories/GHSA-3qh4-842w-fvrm github.com: https://github.com/netdata/netdata/pull/22598 github.com: https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b github.com: https://github.com/netdata/netdata/releases/tag/v2.10.4