CVE-2026-83600
Received Received - Intake

Memory Allocation Failure in Netdata Agent

Publication date: 2026-09-22

Last updated on: 2026-09-22

Assigner: GitHub, Inc.

Description
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-22
Last Modified
2026-09-22
Generated
2026-09-22
AI Q&A
2026-09-22
EPSS Evaluated
N/A
NVD
CVE-2026-83600
EUVD
EUVD-2026-84566

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
netdata netdata 2.10.4
netdata netdata 2.10.0-782-nightly
netdata netdata to 2.10.4 (inc)
netdata netdata to 2.10.4 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.
CWE-193 A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-83600 is a vulnerability in Netdata where an authenticated child agent can send an oversized CHART SLOT value. This causes the parent Netdata agent to attempt allocating approximately 16 GiB of memory, leading to allocation failure and crashing the parent agent. The issue was fixed in version 2.10.4 by adding slot bounds checking to enforce maximum limits.

Detection Guidance

Check Netdata version with 'netdata -v'. If version is below 2.10.4, the system is vulnerable. Monitor agent logs for crashes or 'fatal' errors during streaming operations. Inspect pluginsd_parser logs for slot-related warnings or errors.

Impact Analysis

This vulnerability can cause the Netdata parent agent to crash repeatedly, disabling centralized monitoring and data collection. It results in a denial of service, halting all monitoring activities while the malicious stream access persists. Systems running Netdata versions prior to 2.10.4 are affected.

Mitigation Strategies

Upgrade Netdata to version 2.10.4 or later immediately. If upgrading is not possible, disable streaming features or restrict access to the streaming API. Monitor for malicious slot values in logs and block offending child agents.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-83600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart