Is CVE-2026-83601 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-83601 being exploited in the wild.

How severe is CVE-2026-83601?

Medium severity, with a CVSS score of 6.5, published 22 September 2026.

Is there a fix for CVE-2026-83601?

A patch was published on 2026-07-15: Fix merged in commit 034a774 (cherry-picked from 883928b) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-83601 attacked?

It is attacked over the network.

Am I affected by CVE-2026-83601?

Check whether you run Netdata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-83601: Netdata heap buffer overflow in pluginsd DIMENSION SLOT parsing

CVE-2026-83601 · Severity: medium · CVSS 6.5 · Published 2026-09-22

Netdata is an open-source monitoring and observability platform. An authenticated child agent can trigger a heap buffer overflow in the parent agent by sending an oversized DIMENSION SLOT value, causing the parent to crash or potentially corrupt memory. The vulnerability requires the attacker to be authenticated as a child agent in the Netdata streaming protocol.

Technologies: Netdata. Vendors: Netdata.

Quick answers

Is CVE-2026-83601 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-83601 being exploited in the wild.
How severe is CVE-2026-83601?: Medium severity, with a CVSS score of 6.5, published 22 September 2026.
Which products and versions are affected?: Netdata before 2.10.4.
Is there a fix for CVE-2026-83601?: A patch was published on 2026-07-15: Fix merged in commit 034a774 (cherry-picked from 883928b) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-83601 attacked?: It is attacked over the network.
Am I affected by CVE-2026-83601?: Check whether you run Netdata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An integer wraparound in the allocation calculation within prd_array_create allows an oversized slot value to bypass size validation, resulting in a heap buffer overflow during array initialization. The vulnerability is exploitable by any authenticated child agent or plugin that can send crafted pluginsd protocol messages. Netdata 2.10.4 and later include bounds checking on slot values to prevent this issue.

Affected products

Netdata Netdata before 2.10.4

Timeline

2026-09-22: disclosed: CVE-2026-83601 published
2026-07-15: patched: Fix merged in commit 034a774 (cherry-picked from 883928b)
2026-06-08: patched: Fix authored and available in nightly build 2.10.0-782-nightly

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.