CVE-2026-83600: 
Netdata vulnerability analysis and mitigation

CVE-2026-83600 is a Denial of Service vulnerability in Netdata, an open-source observability tool, caused by an off-by-one error in the streaming protocol's chart slot upper-bound guard. An authenticated child agent can send a CHART command with a slot value of INT32_MAX - 1 (2,147,483,646), bypassing the intended validation and triggering an approximately 16 GiB memory allocation request via reallocz. When this allocation fails, reallocz calls fatal() → abort(), immediately terminating the parent Netdata agent process. All Netdata versions prior to 2.10.4 and nightly build 2.10.0-782-nightly are affected. The vulnerability carries a CVSS v3.1 base score of 6.5 (Medium) (GitHub Advisory, Red Hat).

The root cause is an off-by-one error (CWE-193) in pluginsd_rrdset_cache_put_to_slot within src/plugins.d/pluginsd_internals.h at line 388, where the guard condition if(unlikely(slot < 1 || slot >= INT32_MAX)) uses >= instead of >, allowing the value INT32_MAX - 1 (2,147,483,646) to pass through unchecked (CWE-1285). The slot value is parsed by str2ull_encoded at line 377 with no upstream cap, and the unchecked value is then passed to reallocz(ptr, 2,147,483,646 × sizeof(RRDSET *)), requesting approximately 17,179,869,168 bytes (~16 GiB) of memory (CWE-400). Since reallocz is Netdata's allocation wrapper that calls fatal() — which in turn calls abort() — on any allocation failure, the parent agent process is immediately and reliably terminated. Exploitation requires only network access and a valid streaming API key from stream.conf, which is a pre-shared secret distributed to all child agents (GitHub Advisory, Fix PR).

Successful exploitation causes immediate, reliable, and repeatable termination of the parent Netdata agent process, completely disabling centralized monitoring, alerting, and data collection for all child agents streaming to that parent. The crash is permanent as long as the attacker retains stream access — the parent agent will crash again on every restart upon receiving the malicious CHART command. There is no confidentiality or integrity impact; the vulnerability is purely an availability issue affecting any Netdata deployment using parent-child streaming architecture (GitHub Advisory).

A proof-of-concept exploit is publicly available in the Netdata GitHub Security Advisory (GHSA-3mxw-fv2x-rhc6), which provides concrete step-by-step reproduction instructions including the exact malicious payload (CHART SLOT:2147483646) (GitHub Advisory). The NVD SSVC assessment classifies exploitation status as "poc" with technical impact rated "partial" and automatable as "no" — authentication via a streaming API key is required. The EPSS score is approximately 0.0055 (0.55%), indicating a low but non-negligible probability of exploitation in the wild. There is no evidence of active in-the-wild exploitation or threat actor attribution at this time, and the vulnerability is not listed in the CISA KEV catalog (Feedly).

1. Obtain a valid streaming API key: Acquire the pre-shared API key from stream.conf on a legitimate child agent, via configuration leak, or by intercepting an unencrypted stream connection to the parent Netdata agent.
2. Establish TCP connection: Open a TCP connection to the parent Netdata agent on port 19999 (or the configured stream port).
3. Send a valid streaming handshake: Issue an HTTP GET request to the /stream endpoint with the valid API key and required parameters:

   GET /stream?key=<API_KEY>&hostname=poc-host&machine_guid=<GUID>&os=linux&update_every=1&version=1.99.0 HTTP/1.1
   Host: <TARGET>:19999
   User-Agent: netdata/poc

4. Send the malicious CHART command: After the handshake is accepted, transmit the crafted CHART command with the oversized slot value:

   CHART SLOT:2147483646 cpu.system "" "CPU System" "%" "" line 1000 1 "" "" ""

5. Trigger allocation failure: The parser passes slot value 2,147,483,646 (INT32_MAX - 1) through the off-by-one guard, causing reallocz to attempt a ~16 GiB allocation, which fails on virtually all production systems.
6. Parent agent crashes: reallocz calls fatal() → abort(), immediately terminating the parent Netdata agent process and halting all monitoring. Repeat the attack on every restart to maintain persistent denial of service (GitHub Advisory).

• Network: Unexpected TCP connections to port 19999 (or configured stream port) from unknown or unauthorized hosts; streaming handshake requests (GET /stream?key=...) from sources not in the authorized child agent list.
• Logs: Netdata log entries showing fatal() or abort() calls immediately following receipt of a CHART command; log messages referencing allocation failures for extremely large sizes (~17 GB); repeated parent agent crash/restart cycles in system logs (e.g., journalctl -u netdata).
• Process: Unexpected termination of the netdata parent process; repeated process restarts in a short time window as detected by process monitoring tools or init system logs.
• File System: Core dump files generated by abort() in the Netdata working directory or system core dump location, timestamped around the time of suspected exploitation (GitHub Advisory).

The primary remediation is to upgrade Netdata to version 2.10.4 or nightly build 2.10.0-782-nightly, which introduces per-command slot bounds (PLUGINSD_CHART_SLOT_MAX = 1,000,000 and PLUGINSD_DIMENSION_SLOT_MAX = 65,535) and rejects oversized values with a rate-limited warning instead of crashing (Netdata Release, Fix PR). As a workaround prior to patching, restrict network access to the streaming port (default 19999) using firewall rules to allow only trusted child agent IP addresses, and audit stream.conf to ensure API keys are not exposed. Additionally, implement monitoring and alerting on parent agent process crashes to detect exploitation attempts in progress (GitHub Advisory).

The vulnerability was reported by researcher michaelddickenson and published as a GitHub Security Advisory (GHSA-3mxw-fv2x-rhc6) by Netdata maintainer Ferroin on September 2, 2026 (GitHub Advisory). Red Hat tracked the issue via Bugzilla (Bug 2538307) and assigned it medium severity, reflecting its requirement for authenticated access (Red Hat Bugzilla). The NixOS security tracker also flagged the issue for backporting in nixpkgs. No significant broader media coverage or notable community controversy has been observed.