# CVE-2026-83601: Netdata heap buffer overflow in pluginsd DIMENSION SLOT parsing

Source: https://junglewise.ai/threats/cve-2026-83601-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-an  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-22. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-83601 · Severity: medium · CVSS 6.5 · Published 2026-09-22

Netdata is an open-source monitoring and observability platform. An authenticated child agent can trigger a heap buffer overflow in the parent agent by sending an oversized DIMENSION SLOT value, causing the parent to crash or potentially corrupt memory. The vulnerability requires the attacker to be authenticated as a child agent in the Netdata streaming protocol.

Technologies: [Netdata](https://junglewise.ai/threats/technologies/netdata). Vendors: [Netdata](https://junglewise.ai/threats/vendors/netdata).

## Quick answers

**Is CVE-2026-83601 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-83601 being exploited in the wild.

**How severe is CVE-2026-83601?** Medium severity, with a CVSS score of 6.5, published 22 September 2026.

**Which products and versions are affected?** Netdata before 2.10.4.

**Is there a fix for CVE-2026-83601?** A patch was published on 2026-07-15: Fix merged in commit 034a774 (cherry-picked from 883928b) Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-83601 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-83601?** Check whether you run Netdata at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

An integer wraparound in the allocation calculation within prd_array_create allows an oversized slot value to bypass size validation, resulting in a heap buffer overflow during array initialization. The vulnerability is exploitable by any authenticated child agent or plugin that can send crafted pluginsd protocol messages. Netdata 2.10.4 and later include bounds checking on slot values to prevent this issue.

## Affected products

- Netdata Netdata before 2.10.4

## Timeline

- 2026-09-22: disclosed: CVE-2026-83601 published
- 2026-07-15: patched: Fix merged in commit 034a774 (cherry-picked from 883928b)
- 2026-06-08: patched: Fix authored and available in nightly build 2.10.0-782-nightly

## References

- [https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b](https://github.com/netdata/netdata/commit/034a774f689ac01488fc261ca729ce0875819b1b)
- [https://github.com/netdata/netdata/pull/22598](https://github.com/netdata/netdata/pull/22598)

## Related threats

- [Netdata ndsudo privilege escalation via fail2ban socket](https://junglewise.ai/threats/cve-2026-83603-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-the)
- [Netdata API access control bypass in /api/v3/settings](https://junglewise.ai/threats/cve-2026-83602-netdata-is-an-open-source-observability-tool-from-2-0-0-until-2)
- [Netdata denial of service via oversized CHART SLOT value](https://junglewise.ai/threats/cve-2026-83600-netdata-is-an-open-source-observability-tool-prior-to-2-10-4-an)
- [Netdata WebSocket decompression bomb denial of service](https://junglewise.ai/threats/cve-2026-83599-netdata-is-an-open-source-observability-tool-prior-to-2-11-0)
- [Netdata reflected XSS in ilove.svg endpoint](https://junglewise.ai/threats/cve-2025-71385-netdata-reflected-xss-in-ilove-svg-endpoint)