Is CVE-2026-83600 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83600 being exploited in the wild.

How severe is CVE-2026-83600?

Medium severity, with a CVSS score of 6.5, published 22 September 2026.

Is there a fix for CVE-2026-83600?

A patch was published on 2026-06-08: Fix committed (2.10.4 and nightly 2.10.0-782-nightly) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83600 attacked?

It is attacked over the network, in a hosted service.

Am I affected by CVE-2026-83600?

Check whether you run Netdata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83600: Netdata denial of service via oversized CHART SLOT value

CVE-2026-83600 · Severity: medium · CVSS 6.5 · Published 2026-09-22

Netdata is an open-source monitoring and observability platform used for real-time system metrics collection. An authenticated child agent or plugin can send a malformed CHART SLOT value that causes the parent Netdata agent to attempt allocating approximately 16 GB of memory, triggering an allocation failure that crashes the parent process. This disables centralized monitoring across an entire infrastructure while stream connectivity persists, allowing repeated denial of service attacks.

Technologies: Netdata. Vendors: Netdata.

Quick answers

Is CVE-2026-83600 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83600 being exploited in the wild.
How severe is CVE-2026-83600?: Medium severity, with a CVSS score of 6.5, published 22 September 2026.
Which products and versions are affected?: Netdata prior to 2.10.4.
Is there a fix for CVE-2026-83600?: A patch was published on 2026-06-08: Fix committed (2.10.4 and nightly 2.10.0-782-nightly) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83600 attacked?: It is attacked over the network, in a hosted service.
Am I affected by CVE-2026-83600?: Check whether you run Netdata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

The vulnerability exists in pluginsd_rrdset_cache_put_to_slot() within src/plugins.d/pluginsd_internals.h, where oversized CHART SLOT values from authenticated streams are not validated before being passed to reallocz(), causing excessive memory allocation attempts. An authenticated attacker with stream access can repeatedly trigger parent-agent crashes by sending crafted slot values exceeding sensible bounds. The fix (version 2.10.4 and nightly build 2.10.0-782-nightly) implements PLUGINSD_CHART_SLOT_MAX bounds checking to reject invalid slot values.

Affected products

Netdata Netdata prior to 2.10.4

Timeline

2026-09-22: disclosed: CVE-2026-83600 published
2026-06-08: patched: Fix committed (2.10.4 and nightly 2.10.0-782-nightly)

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.