Skip to content
OpenAdvisories
High USN-7250-1 5 CVEs

netdata vulnerabilities

Published Feb 3, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Netdata incorrectly handled parsing JSON input,
which could lead to a JSON injection. An attacker could possibly use
this issue to execute arbitrary code. This issue only affected
Ubuntu 18.04 LTS. (CVE-2018-18836)

It was discovered that Netdata incorrectly handled parsing HTTP headers,
which could lead to a HTTP header injection. An attacker could possibly
use this issue to cause a denial of service or leak sensitive information.
This issue only affected Ubuntu 18.04 LTS. (CVE-2018-18837)

It was discovered that Netdata incorrectly handled parsing URLs, which
could lead to a log injection. An attacker could possibly use this issue
to consume system resources, resulting in a denial of service. This issue
only affected Ubuntu 18.04 LTS. (CVE-2018-18838)

It was discovered Netdata improperly authenticated API keys. An attacker
could possibly use this issue to leak sensitive information or execute
arbitrary code. This issue only affected Ubuntu 20.04 LTS and
Ubuntu 22.04 LTS. (CVE-2023-22497)

It was discovered Fluent Bit, vendored in Netdata, incorrectly handled
parsing HTTP payloads. An attacker could possibly use this issue to
disrupt logging. This issue only affected Ubuntu 24.10. (CVE-2024-23722)

It was discovered that WebAssembly Micro Runtime, vendored in Netdata,
incorrectly handled memory. An attacker could possibly use this issue to
cause a denial of service. This issue only affected Ubuntu 24.10.
(CVE-2024-34250, CVE-2024-34251)

Fixed packages 3

ReleasePackageFixed in
Ubuntu · Pro 18.04 LTS Pro:18.04:LTS netdata 1.9.0+dfsg-1ubuntu0.1~esm1
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS netdata 1.19.0-3ubuntu1+esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS netdata 1.33.1-1ubuntu1+esm1

Vulnerabilities 5

  • High 7.5
    CVE-2024-23722 Public exploit

    In Fluent Bit 2.1.8 through 2.2.1, a NULL pointer dereference can be caused via an invalid HTTP payload with the conten…

    fluent-bit Azure Linux
  • Medium 6.5
    CVE-2023-22497

    Netdata is vulnerable to improper authentication

    Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. Each Netdata Agent has an automatically generated MACHINE GUID. It is generated when the agent first starts and it is saved to disk, so that it will persist across r…

    netdata netdata netdata netdata Debian Ubuntu
  • Unscored —
    CVE-2018-18836

    An issue was discovered in Netdata 1.10.0. JSON injection exists via the api/v1/data tqx parameter because of web_clien…

    netdata netdata Debian Ubuntu
  • Unscored —
    CVE-2018-18837

    An issue was discovered in Netdata 1.10.0. HTTP Header Injection exists via the api/v1/data filename parameter because …

    netdata netdata Debian Ubuntu
  • Unscored —
    CVE-2018-18838

    An issue was discovered in Netdata 1.10.0. Log Injection (or Log Forgery) exists via a %0a sequence in the url paramete…

    netdata netdata Debian Ubuntu

References

  • report
    https://ubuntu.com/security/CVE-2018-18836
  • report
    https://ubuntu.com/security/CVE-2018-18837
  • report
    https://ubuntu.com/security/CVE-2018-18838
  • report
    https://ubuntu.com/security/CVE-2023-22497
  • report
    https://ubuntu.com/security/CVE-2024-23722
  • report
    https://ubuntu.com/security/CVE-2024-34250
  • report
    https://ubuntu.com/security/CVE-2024-34251