Netdata CVE-2025-8900: Off-by-one in streaming protocol triggers 16GiB allocation and agent crash

Vulnerability Summary Vulnerability Overview Title: Streaming protocol chart slot guard off-by-one allows ~16 GiB allocation request, crashing parent agent Type: Off-by-one error Severity: Moderate CVSS 3.1 Score: 6.5 / 10 CVE ID: CVE-2025-8900 CWE: CWE-193 (Off-by-one Error), CWE-400 (Uncontrolled Resource Consumption) Description: In 's streaming protocol parser, the chart slot upper-bound check contains an off-by-one error. This vulnerability allows an authenticated child agent to send a slot value of (2,147,483,646), bypassing the limit and triggering a memory allocation request of approximately 16 GiB. Because is called when fails, the parent agent process terminates immediately. Affected Scope Affected Software: Affected Versions: , Affected File: - function , line 388 Root Cause: The code uses a less-than-or-equal-to comparison ( ) instead of less-than ( ), allowing to pass the check. Impact: Any Netdata deployment using parent-child streaming. The parent agent (which centrally monitors multiple child agents) crashes immediately, disrupting monitoring, alerting, and data collection. Because the crash occurs on every restart, it results in permanent monitoring failure. Remediation Fixed Versions: , Fix Logic: Change the check condition from to , or subtract 1 from the constant. POC / Exploit Code Prerequisites: A valid streaming API key (located in ) is required. Exploitation Steps: 1. Establish a TCP connection to port 19999 (or the configured stream port) of the parent Netdata agent. 2. Send a valid streaming handshake: 3. After the handshake is accepted, send: 4. The parent agent calls to allocate ~16 GiB, which fails, triggering -> -> process termination. Verification Script:** (pure Python, no dependencies) confirms that passes the guard and generates an allocation request of 17,179,869,186 bytes.

Goal Reached Thanks to every supporter — we hit 100%!

Netdata CVE-2025-8900: Off-by-one in streaming protocol triggers 16GiB allocation and agent crash

More from this source