{"id":"CVE-2026-83600","summary":"Netdata: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent","details":"Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.","aliases":["GHSA-3mxw-fv2x-rhc6"],"modified":"2026-09-25T08:24:16.256517Z","published":"2026-09-22T17:05:15.155Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-193","CWE-400"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83600.json"},"references":[{"type":"WEB","url":"https://github.com/netdata/netdata/releases/tag/v2.10.4"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/83xxx/CVE-2026-83600.json"},{"type":"ADVISORY","url":"https://github.com/netdata/netdata/security/advisories/GHSA-3mxw-fv2x-rhc6"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-83600"},{"type":"FIX","url":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b"},{"type":"FIX","url":"https://github.com/netdata/netdata/pull/22598"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/netdata/netdata","events":[{"introduced":"0"},{"fixed":"034a774f689ac01488fc261ca729ce0875819b1b"},{"fixed":"245283237171400672a9ad914f5785ba8bc0fa5c"}],"database_specific":{"extracted_events":[{"introduced":"0"},{"fixed":"2.10.4"}],"source":["AFFECTED_FIELD","REFERENCES"]}}],"versions":["v2.10.3","v2.10.2","v2.10.1","v2.10.0","v2.9.0","v2.8.0","v2.7.0","v2.6.0","v2.5.0","v2.4.0","v2.3.0","v2.2.0","v2.1.0","v2.0.0","v1.47.0","v1.99.0","v1.46.0","v1.45.0","v1.44.0","v1.43.0","v1.42.0","v1.41.0","v1.40.0","v1.39.0","v1.38.0","v1.37.0","v1.36.0","v1.35.0","v1.34.0","1.34.0","v1.33.1","v1.33.0","v1.32.1","1.32.1","v1.32.0","v1.31.0","v1.30.1","v1.30.0","v1.29.3","v1.29.2","v1.29.1","v1.29.0","v1.27.0_0104103941","v1.28.0","v1.27.0","v1.26.0","v1.25.0","v1.24.0","v1.23.2","v1.23.1_infiniband","v1.23.1","v1.23.0","v1.22.1","v1.22.0","v1.21.1","v1.21.0","v1.20.0","v1.19.0","v1.18.1","v1.18.0","v1.17.1","v1.17.0","v1.16.1","v1.16.0","v1.15.0","v1.14.0","v1.14.0-rc0","v1.13.0","v1.12.2","v1.12.1","v1.12.0","v1.12.0-rc3","v1.12.0-rc2","v1.12.0-rc1","v1.12.0-rc0","v1.11.1","v1.11.0","v1.10.0","untagged-10d59b9e5fa68b9500e1","v1.9.0","v1.8.0","v1.7.0","v1.6.0","v1.5.0","v1.4.0","v1.3.0","v1.2.0","v1.1.0","v1.0.0","v1.0rc","v0.2","v0.1"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-83600.json","vanir_signatures_modified":"2026-09-25T08:24:16Z","vanir_signatures":[{"source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_replication.c"},"deprecated":false,"digest":{"line_hashes":["275856564871039142571748085483436055796","19531837162614562575916596320850400052","126165296272499581908659644287063379262","221952509254567874068947121503741680931","235852811495421466668362971080690750490","300887988076046886117211170393250733676","233733429786838611417307219141074953610","7419981367261666687226690700296634812","65549429162019930013642415270285927167","92263727938840291507958190905107988008","233733429786838611417307219141074953610","321674952484545507499750671130973393224"],"threshold":0.9},"id":"CVE-2026-83600-01aec10d","signature_type":"Line","signature_version":"v1"},{"digest":{"function_hash":"19357177190979614424669682474999920757","length":244},"id":"CVE-2026-83600-02314095","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/database/rrdset-pluginsd-array.h","function":"prd_array_create"},"deprecated":false},{"digest":{"function_hash":"10972088444585927018751113097340230688","length":3092},"id":"CVE-2026-83600-354a697d","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_parser.c","function":"pluginsd_chart"},"deprecated":false},{"deprecated":false,"digest":{"function_hash":"288684311065241534832305349421556838684","length":1110},"id":"CVE-2026-83600-374d31c5","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_parser.c","function":"pluginsd_parser_unittest"}},{"digest":{"line_hashes":["292089169359287678564934854686870524440","204481126198128348748296080955228897590","233733429786838611417307219141074953610","226371057227108524172577221106181076288","160021001982921169666270143637614052005","233691446439150846395273614420514677587","126165296272499581908659644287063379262","119106041851891312648333464836744510433","246332533149892959329246647284743960595","321855048917427641664381300646097166025","118917127567660546680602225583392548411","138696913108387528249288055300566638466","52630811489948146450312869414439885018","203257320953421866222351396149824477114","126165296272499581908659644287063379262","104308581024715418002575324570732905751","127133685509283184737816432788390529842","279171371955986794248091804985169078531","126165296272499581908659644287063379262","257982878278850558121067722011497654808","258428239048470496310629936250123714405","279171371955986794248091804985169078531","233733429786838611417307219141074953610","210161898806498168078366726270242764769","302290377082727226074073430540719179860","337544435851602671161519121399492486385","144225359110750592088986736580565354295","258783755745401106061337949458694607280"],"threshold":0.9},"id":"CVE-2026-83600-487cd508","signature_type":"Line","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_parser.c"},"deprecated":false},{"id":"CVE-2026-83600-5d302e82","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_replication.c","function":"pluginsd_replay_set"},"deprecated":false,"digest":{"function_hash":"69217808361497987208942809056301625453","length":2122}},{"target":{"file":"src/plugins.d/pluginsd_internals.h"},"deprecated":false,"digest":{"line_hashes":["306887564854651161440823370420337986798","165356380283984424153066716717792593013","209042271873413767957152594606777506211","8299762840233747032629733473557940178","272138389872318068469047964875732271904","248826437775961262513464271228570730188","161409725374827438059564376353391404602","225776584656116462443185444431539768881","61507563572395026569935190244599553898","53968041948500702836082629265159395686"],"threshold":0.9},"id":"CVE-2026-83600-72090494","signature_type":"Line","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b"},{"target":{"file":"src/plugins.d/pluginsd_parser.c","function":"pluginsd_begin_v2"},"deprecated":false,"digest":{"function_hash":"110936696595376141746415525858946644949","length":3917},"id":"CVE-2026-83600-776f6d14","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_replication.c","function":"pluginsd_replay_rrddim_collection_state"},"deprecated":false,"digest":{"function_hash":"185914282203576392542351940572983871231","length":1912},"id":"CVE-2026-83600-8f7508e5"},{"id":"CVE-2026-83600-9277ec85","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_replication.c","function":"pluginsd_replay_begin"},"deprecated":false,"digest":{"function_hash":"331297291880290759397548431560555924226","length":3417}},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"function":"pluginsd_begin","file":"src/plugins.d/pluginsd_parser.c"},"deprecated":false,"digest":{"function_hash":"41923450896033773902579705171125417095","length":1475},"id":"CVE-2026-83600-a9c2377b"},{"deprecated":false,"digest":{"length":1076,"function_hash":"213775507284326306180158927689965086232"},"id":"CVE-2026-83600-c56d8546","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_parser.c","function":"pluginsd_set"}},{"deprecated":false,"digest":{"line_hashes":["58569146048499133529552538097150247054","297263766378500657694059056993605539371","88749039815519928597227667328714934391","133231939066133453391454132863847282835"],"threshold":0.9},"id":"CVE-2026-83600-d518f23f","signature_type":"Line","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/database/rrdset-pluginsd-array.h"}},{"deprecated":false,"digest":{"function_hash":"317178619577397589943209967632468447595","length":3042},"id":"CVE-2026-83600-d588328b","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_parser.c","function":"pluginsd_dimension"}},{"signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_internals.h","function":"pluginsd_parse_rrd_slot"},"deprecated":false,"digest":{"function_hash":"328412245075000376955808071234255341911","length":416},"id":"CVE-2026-83600-ed20258d","signature_type":"Function"},{"deprecated":false,"digest":{"function_hash":"125803494955485833829754668137229545470","length":4666},"id":"CVE-2026-83600-f89b1e3c","signature_type":"Function","signature_version":"v1","source":"https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b","target":{"file":"src/plugins.d/pluginsd_parser.c","function":"pluginsd_set_v2"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"}]}