CVE-2026-83600: Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ullencoded passes to pluginsdrrdsetcacheputtoslot in src/plugins.d/pluginsdinternals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netdatato a version that resolves this vulnerability.Fixed in 2.10.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Netdata versions prior to 2.10.4 are affected where the parent agent accepts streaming connections from an authenticated child agent. The impact is repeated loss of the parent agent and centralized monitoring while that stream access remains available.
What access does an attacker need to trigger the crash?
An attacker needs authenticated child-agent streaming access. They can send an oversized CHART SLOT value through the streaming protocol, causing the parent agent to request an approximately 16 GiB allocation and abort if allocation fails.
What versions contain the fix?
The issue is fixed in Netdata 2.10.4 and in nightly build 2.10.0-782-nightly.