An authenticated child agent can send an oversized CHART SLOT value that triggers an off‑by‑one error in the parent Netdata agent, causing the agent to request an array approximately 16 GiB in size and resulting in allocation failure, which invokes a fatal error that aborts the parent process and repeatedly disables centralized monitoring while stream access continues.

Netdata (netdata:netdata) versions earlier than 2.10.4, including nightly builds older than 2.10.0-782-nightly; the vulnerability affects the parent Netdata agent when it receives data from an authenticated child agent.

The CVSS base score is 6.5 and no EPSS score is available; the vulnerability is not listed in the CISA KEV catalog. Exploitation requires access to a child agent with authentication, but once triggered it causes a crash that disables the parent agent, disrupting monitoring services. Therefore the risk is moderate to high for environments that rely on continuous monitoring and that permit authenticated child agents to stream data.