6.5

CVE-2026-83600: netdata Off-by-one Error

CVSS: 6.5v3.1MediumAwaiting analysis
AliasesUBUNTU-CVE-2026-83600DEBIAN-CVE-2026-83600
Published 22-09-2026Last modified 22-09-2026
Open JSON

Vulnerability summary

CVE-2026-83600 is a medium (CVSS 6.5) Off-by-one Error vulnerability in netdata. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 45% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.55%
0%100%
Low · Change unavailable
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Timeline

  1. 22-09-2026
    PublishedVulnerability first disclosed.
  2. 22-09-2026
    Last modifiedVulnerability information updated.

Description

Netdata is an open source observability tool. Prior to 2.10.4, an authenticated child agent can send an oversized CHART SLOT value that str2ull_encoded passes to pluginsd_rrdset_cache_put_to_slot in src/plugins.d/pluginsd_internals.h. The accepted slot drives reallocz to request an approximately 16 GiB chart-pointer array, and allocation failure invokes fatal and aborts the parent Netdata agent, repeatedly disabling centralized monitoring while stream access persists. This issue is fixed in version 2.10.4 and nightly build 2.10.0-782-nightly.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.55%

Chance of exploitation in the next 30 days

Percentile

45%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

23-09-202621-10-2026
EPSS score
0.55%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Debian1 product
  • netdataAll versions (No fix recorded)
Netdata1 product
Ubuntu1 product
  • netdataAll versions (No fix recorded)

3 vendors · 3 products

References

7 links