CVE-2026-83600: Netdata Agent DOS Vulnerability

CVE-2026-83600 Overview

Netdata is an open source observability tool used for real-time infrastructure monitoring. CVE-2026-83600 is a denial-of-service vulnerability affecting Netdata versions prior to 2.10.4. An authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array. Allocation failure invokes fatal and aborts the parent Netdata agent. Attackers can repeatedly crash the centralized monitoring instance while stream access persists. The issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

Critical Impact
A single authenticated streaming child can repeatedly crash the parent Netdata agent, disabling centralized observability for all monitored hosts.

Affected Products

Netdata versions prior to 2.10.4
Netdata nightly builds prior to 2.10.0-782-nightly
Parent Netdata agents accepting streaming connections from child agents

Discovery Timeline

2026-09-22 - CVE CVE-2026-83600 published to NVD
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-83600

Vulnerability Analysis

The flaw is a resource exhaustion condition triggered through Netdata's streaming protocol. When a child agent streams metrics to a parent, it can issue a CHART command with a SLOT: prefix that encodes a slot index. The parser pluginsd_parse_rrd_slot invokes str2ull_encoded to decode the value and passes it directly to pluginsd_rrdset_cache_put_to_slot without enforcing an upper bound. The cache logic uses the slot as an array index and calls reallocz to grow the chart-pointer array to accommodate it. A slot value large enough to request roughly 16 GiB of contiguous memory reliably fails, and Netdata's fatal handler responds by aborting the parent process. The bug is categorized under CWE-193 (Off-by-one / boundary miscalculation) because the missing bound check permits unbounded slot values to drive allocation size.

Root Cause

The root cause is the absence of a bounds check on parsed slot values. pluginsd_parse_rrd_slot accepted any 64-bit unsigned integer decoded from the streaming input, and downstream consumers treated the value as a trusted cache index. Neither the parser nor prd_array_create validated that the requested allocation size was bounded by a compile-time cap such as PLUGINSD_DIMENSION_SLOT_MAX.

Attack Vector

Exploitation requires an authenticated streaming child agent. The attacker sends a CHART SLOT:<huge_value> command over the streaming channel. The parent agent allocates on the requested slot, reallocz fails, and fatal terminates the process. Because streaming credentials persist across restarts, the child can repeat the attack to keep centralized monitoring offline.

// Security patch in src/plugins.d/pluginsd_internals.h
// Adds a max_slot bound and rejects oversized SLOT values.
static ALWAYS_INLINE ssize_t pluginsd_parse_rrd_slot(char **words, size_t num_words, size_t max_slot) {
    internal_fatal(max_slot > (size_t)SSIZE_MAX,
                   "PLUGINSD: max_slot %zu exceeds SSIZE_MAX", max_slot);

    ssize_t slot = -1;
    char *id = get_word(words, num_words, 1);
    if(id && id[0] == PLUGINSD_KEYWORD_SLOT[0] && id[1] == PLUGINSD_KEYWORD_SLOT[1] &&
       id[2] == PLUGINSD_KEYWORD_SLOT[2] && id[3] == PLUGINSD_KEYWORD_SLOT[3] && id[4] == ':') {
        unsigned long long parsed_slot = str2ull_encoded(&id[5]);
        if(unlikely(parsed_slot > max_slot)) {
            nd_log_limit_static_global_var(erl_slot, 1, 0);
            nd_log_limit(&erl_slot, NDLS_COLLECTORS, NDLP_WARNING,
                         "PLUGINSD: ignoring invalid SLOT value '%s' above the supported maximum %zu",
                         &id[5], max_slot);
        }
    }
}
// Source: https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b

Detection Methods for CVE-2026-83600

Indicators of Compromise

Repeated abnormal termination of the parent netdata process with fatal messages referencing allocation failure.
Streaming child agents sending CHART SLOT: commands with slot values above PLUGINSD_CHART_SLOT_MAX.
Sudden memory pressure or OOM events on the parent host coinciding with a specific child connection.

Detection Strategies

Parse Netdata error and daemon logs for fatal entries emitted by reallocz or pluginsd code paths.
Correlate parent agent restarts with the streaming child that connected immediately beforehand.
Monitor for the patched warning string ignoring invalid SLOT value on upgraded hosts to identify probing children.

Monitoring Recommendations

Ingest Netdata daemon logs into your SIEM or observability pipeline and alert on repeated fatal events.
Track streaming connection metadata (source IP, machine GUID, API key) alongside parent restarts.
Baseline resident memory of the parent Netdata process and alert on sharp spikes preceding a crash.

How to Mitigate CVE-2026-83600

Immediate Actions Required

Upgrade all parent Netdata agents to version 2.10.4 or nightly build 2.10.0-782-nightly or later.
Audit the list of streaming API keys and machine GUIDs authorized to stream to each parent.
Revoke streaming credentials for any child agents that are untrusted or no longer required.

Patch Information

The fix is delivered in Netdata 2.10.4 via pull request GitHub Pull Request #22598 and commit 034a774. Details are documented in GitHub Security Advisory GHSA-3mxw-fv2x-rhc6 and the GitHub Release v2.10.4. The patch adds a max_slot parameter to pluginsd_parse_rrd_slot, enforces PLUGINSD_*_SLOT_MAX caps, and documents the allocation invariant in prd_array_create.

Workarounds

Restrict inbound streaming ports so only trusted child hosts can reach the parent agent.
Rotate streaming API keys and remove entries in stream.conf for any child that does not require the parent link.
Place a network policy or firewall in front of the parent to rate-limit or drop streaming traffic from suspicious sources until the upgrade is applied.

bash

# Verify the installed Netdata version and upgrade
netdata -v
# Debian/Ubuntu
apt-get update && apt-get install --only-upgrade netdata
# RHEL/CentOS
dnf upgrade netdata
# Confirm the patched build
netdata -v | grep -E "2\.10\.4|2\.10\.0-78[2-9]-nightly"