Netdata Agent EUVD-2026-84566

Requires an authenticated child agent with active streaming access to the target parent Netdata agent (the parent-child streaming/replication feature must be in use and the malicious child must be accepted into the streaming topology). The attacker then sends an oversized CHART SLOT value in the pluginsd streaming protocol. Limiting factors: PR:L means the attacker must control or compromise a streaming child rather than being an anonymous remote user; deployments where only fully trusted children stream to the parent, or standalone/non-streaming agents, are not exposed. Affects versions prior to 2.10.4 (fixed in 2.10.4 and nightly 2.10.0-782).

This is a genuine but bounded availability issue, not a top-tier priority. The vendor CVSS 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) is well-calibrated: network vector and low complexity, but PR:L is doing real limiting work - exploitation requires an AUTHENTICATED streaming child agent already accepted into the parent's streaming topology, so the attacker must control or compromise a child node, not merely reach the network. Impact is pure availability (C:N/I:N/A:H): a repeatable fatal-abort of the parent that persistently disables centralized monitoring, which is serious in an observability/blind-spot sense but involves no data disclosure or code execution. No EPSS score, no CISA KEV listing, and no public POC were provided; per precision rules this is 'no public exploit identified at time of analysis.' Signals are consistent rather than conflicting - the only metadata problem is the 'Information Disclosure' tag, which directly contradicts the C:N/I:N/A:H vector (this is a denial-of-service, CWE-193 numeric mishandling driving an oversized allocation). Net: patch in due course, prioritized by whether untrusted or lower-trust children can stream to a given parent; not an emergency for isolated/trusted streaming deployments.

An attacker who controls or has compromised a Netdata child agent that streams to a parent sends a crafted pluginsd CHART line with an oversized SLOT value; str2ull_encoded accepts it unbounded and drives reallocz toward a ~16 GiB chart-pointer array, whose allocation failure triggers fatal and aborts the parent agent. The attacker replays this whenever the parent restarts, keeping centralized monitoring down while stream access persists. No public POC is referenced, but the trigger is a single malformed streaming line and complexity is low (AC:L).