CVE-2026-83600 in Netdata
Summary
by MITRE • 09/22/2026
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/22/2026
The vulnerability identified in Netdata prior to version 2.10.4 represents a critical resource exhaustion flaw stemming from insufficient input validation within the agent-to-parent communication protocol. As an open-source observability tool, Netdata relies on a hierarchical architecture where child agents stream metrics data to parent nodes for centralized aggregation and visualization. The specific defect resides in the handling of the CHART SLOT parameter during this streaming process. When an authenticated child agent transmits an oversized value for this slot, it is passed through the str2ull_encoded function without adequate bounds checking or sanity verification before being utilized as a size argument for memory allocation routines. This lack of validation allows maliciously crafted inputs to bypass standard safety checks inherent in normal operational parameters.
The technical consequence of this flaw involves the invocation of reallocz within the pluginsd_rrdset_cache_put_to_slot function located in src/plugins.d/pluginsd_internals.h. The system interprets the oversized slot value as a request for memory allocation, specifically attempting to allocate an array of chart pointers with a size calculated based on the input. In this specific instance, the malformed input triggers a request for approximately 16 GiB of RAM. This magnitude far exceeds typical available resources and standard buffer limits designed for metric storage structures. The operating system or runtime environment fails to satisfy such a massive allocation request, leading directly to an allocation failure condition within the application logic.
The operational impact of this vulnerability is severe due to the defensive coding practices employed by Netdata in response to memory errors. Upon detecting the allocation failure, the parent agent does not gracefully handle the error or isolate the faulty child connection. Instead, it invokes a fatal handler that triggers an abort sequence for the entire process. This results in the immediate termination of the parent Netdata agent service. Consequently, centralized monitoring capabilities are disabled until the service is manually restarted. If stream access from the compromised child agent persists, this cycle can repeat indefinitely, creating a persistent denial-of-service condition that disrupts visibility into infrastructure health and performance metrics for all connected systems relying on that central node.
From a classification perspective, this vulnerability aligns with CWE-789: Memory Allocation with Excessive Size Value, as the application accepts an input value that leads to an excessively large memory allocation request. It also relates to CWE-400: Uncontrolled Resource Consumption, where the resource exhaustion is triggered by specific crafted inputs rather than general high load. In terms of attack vectors and tactics, this flaw can be exploited for Denial-of-Service (DoS) attacks under MITRE ATT&CK technique T1499: Endpoint Denial of Service or T1529: System Shutdown/Reboot if the abort leads to service unavailability that requires manual intervention. The requirement for authentication indicates that this is not a remote code execution vulnerability accessible to unauthenticated actors, but rather an insider threat or compromised credential scenario where an attacker with access to child agent credentials can disrupt critical monitoring infrastructure.
Mitigation strategies primarily involve upgrading to Netdata version 2.10.4 or the nightly build 2.10.0-782-nightly and later, which contain patches addressing this input validation gap. Until such upgrades are implemented in production environments, administrators should enforce strict network segmentation between child agents and parent nodes using firewalls or zero-trust principles to limit exposure. Additionally, implementing rate limiting on the streaming protocol can help mitigate the frequency of malicious requests. Monitoring system logs for repeated agent restarts or memory allocation errors associated with pluginsd_rrdset_cache_put_to_slot may provide early detection indicators for this specific exploitation attempt.