Vulnerability · Published Sep 22, 2026 · Assigned by GitHub_M

CVE-2026-83601Netdata: Streaming protocol dimension slot has no upper-bound guard, allowing integer overflow and out-of-bounds write

Medium 6.5

In plain English

A medium-severity integer overflow in netdata from netdata. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 31% of all known vulnerabilities).

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.4%top 68.8% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized DIMENSION SLOT value that str2ull_encoded passes to pluginsd_rrddim_put_to_slot in src/plugins.d/pluginsd_internals.h without an upper bound. prd_array_create in src/database/rrdset-pluginsd-array.h can then wrap the size_t allocation calculation while retaining the original large array size, causing the subsequent initialization loop to write beyond the undersized heap allocation and crash the parent agent. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	netdata	no fix listed	DEBIAN-CVE-2026-83601
Ubuntu:24.04:LTS	netdata	no fix listed	UBUNTU-CVE-2026-83601

Affected products (as reported)

Vendor	Product	Versions
netdata	netdata	< 2.10.4

Weakness: CWE-190, CWE-787 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/netdata/netdata/security/advisories/GHSA-3qh4-842w-fvrm x_refsource_CONFIRM
https://github.com/netdata/netdata/pull/22598 x_refsource_MISC
https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b x_refsource_MISC
https://github.com/netdata/netdata/releases/tag/v2.10.4 x_refsource_MISC