Netdata CVE-2026-83601

Requires a Netdata parent-child streaming deployment where the attacker controls or has compromised an authenticated child agent that streams to a parent (PR:L). The malicious child sends an oversized DIMENSION SLOT value exceeding the parser's cap, exploiting the pluginsd slot handling in versions prior to 2.10.4. Exploitation is limited to availability (crash of the parent agent) with no confidentiality or integrity impact, requires no user interaction, and is closed by upgrading to 2.10.4 or nightly 2.10.0-782 where the value is capped at PLUGINSD_DIMENSION_SLOT_MAX/PLUGINSD_CHART_SLOT_MAX.

Signals are consistent and point to a moderate, not urgent, DoS issue. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H, base 6.5) is availability-only with no confidentiality or integrity impact - the description and patch confirm this is a heap out-of-bounds write that crashes the parent agent, not code execution. PR:L is accurate: the attacker must be an authenticated child agent in a Netdata parent-child streaming topology, which meaningfully constrains reach versus a fully unauthenticated flaw. No EPSS score, no CISA KEV listing, and no public exploit are present in the provided data - so no public exploit identified at time of analysis, and no evidence of active exploitation. No SSVC decision data was supplied. The signals do not conflict; the main gating factor is the trust/authentication prerequisite (a compromised or malicious streaming child). This is a real, verifiable bug (source diff and fix commit confirm the integer-overflow root cause), but it is a targeted availability risk against streaming deployments rather than a broadly weaponizable, high-priority issue.

An attacker who controls or has compromised a Netdata child agent that streams metrics to a central parent connects and emits a crafted DIMENSION line carrying an oversized SLOT value (e.g. the reported 0x40000000). The unbounded value wraps the parent's size_t allocation math in prd_array_create, and the initialization loop writes past the undersized heap buffer, crashing the parent agent and halting monitoring for everything aggregated there. No public exploit code is identified, but the fix commit and unit tests reveal the exact triggering values.