CVE-2026-83601: Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ullencoded passes to pluginsdrrddimputtoslot in src/plugins.d/pluginsdinternals.h without an upper bound. prdarraycreate in src/database/rrdset-pluginsd-array.h can then wrap the sizet allocation calculation while retaining the original large array size, causing the subsequent initialization loop to write beyond the undersized heap allocation and crash the parent agent. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Netdatato a version that resolves this vulnerability.Fixed in 2.10.4
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Parent Netdata agents that accept streaming data from authenticated child agents are exposed. The vulnerable path is triggered by a child agent sending a DIMENSION SLOT value through the streaming protocol.
What access does an attacker need to exploit it?
An attacker needs authentication as a Netdata child agent able to send streaming-protocol data to a parent agent. No user interaction is required.
What is the practical impact of successful exploitation?
A malicious oversized DIMENSION SLOT value can cause an integer overflow during allocation and an out-of-bounds heap write during initialization. This can crash the parent agent, resulting in a denial of service.
Which versions contain a fix?
The issue is fixed in Netdata version 2.10.4 and nightly build 2.10.0-782-nightly. Versions prior to 2.10.4 are affected according to the available information.