CVE-2026-83600mediumCWE-193CWE-400

CVE-2026-83600: medium-severity vulnerability in netdata

Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent

Published

Follow this CVE+ Monitor netdata+ Monitor netdata

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.5%
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Affected products
netdata · netdata
Related CVEs — netdata

In the same product, most dangerous first.

CVE-2023-22496HIGHNetdata vulnerable to command injection EPSS 36.2%CVE-2024-32019HIGHndsudo: local privilege escalation via untrusted search pathEPSS 1.2%CVE-2026-83599HIGHNetdata: WebSocket Decompression BombEPSS 0.7%CVE-2023-22497MEDIUMNetdata is vulnerable to improper authenticationEPSS 0.7%CVE-2025-71385MEDIUMNetdata < 2.3.1 - Reflected Cross-Site Scripting via love Parameter in ilove.svg EndpointEPSS 0.4%CVE-2026-83601MEDIUMNetdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds writeEPSS 0.4%