CVE-2026-83601
MediumCVSS 6.5Summary
In Netdata prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot without an upper bound. prd_array_create can then wrap the size_t allocation calculation while retaining the original large array size, causing the initialization loop to write beyond the undersized heap allocation and crash the parent agent.
Risk Assessment
An authenticated child agent can remotely crash the parent Netdata agent, disrupting monitoring. In a worst case, the heap overflow could potentially lead to code execution in the parent process context.
Recommendation
Upgrade Netdata to version 2.10.4 or later (or nightly 2.10.0-782-nightly). Restrict the ability to register unknown child agents in your infrastructure.
Other vulnerabilities in Netdata
See all- CVE-2026-83603High
Netdata prior to 2.10.4 contains a vulnerability in the setuid-root ndsudo helper command fail2ban-client-status-socket which accepts a caller-controlled --socket_path from the low-privileged netdata service account, allowing attacker-controlled code to execute as root on systems with fail2ban-client installed.
- CVE-2026-83602Medium
In Netdata from 2.0.0 until 2.11.0, the /api/v3/settings endpoint is registered with HTTP_ACL_NOCHECK and HTTP_ACCESS_ANONYMOUS_DATA, allowing unauthenticated PUT requests to bypass operator-configured IP allow restrictions. An attacker can persist attacker-controlled JSON in {varlib}/settings/default.json, manipulate its version counter, and use repeated near-20 MiB writes to consume disk space.
- CVE-2026-83600Medium
In Netdata prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent.
- CVE-2026-83599High
Netdata prior to 2.11.0 contains a vulnerability in the unauthenticated WebSocket server that allows an attacker to send small highly compressed frames, leading to large server-side allocations and causing memory exhaustion and termination of monitoring.
- CVE-2026-83598High
Netdata from 2.0.0 to 2.10.4 contains a vulnerability during MSI repair where powershell.exe runs as SYSTEM without -NoProfile and loads the user's PowerShell profile, allowing commands placed in that profile to execute with SYSTEM privileges.
- CVE-2025-71385Medium
Reflected XSS vulnerability in Netdata before 2.3.1 in the api/v2/ilove.svg and api/v3/ilove.svg endpoints. An attacker can inject malicious JavaScript via the love parameter, which is reflected in the SVG response without proper encoding. The endpoints are accessible without authentication, allowing remote script execution in the victim's browser.
Original NVD description (English source)
Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot in src/plugins.d/pluginsd_internals.h without an upper bound. prd_array_create in src/database/rrdset-pluginsd-array.h can then wrap the size_t allocation calculation while retaining the original large array size, causing the subsequent initialization loop to write beyond the undersized heap allocation and crash the parent agent. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.