Netdata allows an authenticated child agent to send a dimension slot value that exceeds its intended bounds. The value passes unchecked into a conversion routine, which then feeds a size calculation that overflows a size_t, allocating far less memory than the loop will write. The over‑running write corrupts heap memory and forces the parent agent to crash, interrupting observability services for that host.

Any instance of Netdata running before version 2.10.4, on the netdata:netdata product. The flaw is triggered by a child agent that has authentication privileges on the Netdata host; any such configured agent can trigger the crash.

The vulnerability carries a CVSS score of 6.5, indicating moderate severity. EPSS is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting no widespread exploits have been reported. The attack requires authenticated access to a child agent, so it is limited to attackers who have valid credentials or can instantiate a child agent. While this cannot lead to code execution, it can be used to cause a Denial of Service by crashing the parent agent.