CVE-2026-84304: gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Deferred

AliasesUBUNTU-CVE-2026-84304DEBIAN-CVE-2026-84304CGA-225h-p4f8-5x6c+7789 more

Published 01-09-2026Last modified 01-09-2026

Vulnerability summary

CVE-2026-84304 is a high (CVSS 8.7) Uncontrolled Resource Consumption vulnerability in grpc grpc-go. EPSS estimates a 0.61% chance of exploitation in the next 30 days, higher than 49.1% of scored vulnerabilities.

Priority

Prioritisesevere

Severe, CVSS 8.7 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?

CVSS score

8.7/10

010

High · v4.0 (CVE.org)

EPSS score

0.61%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 71 · Related 72

OPENSUSE-SU-2026:11686-1 OPENSUSE-SU-2026:11695-1 OPENSUSE-SU-2026:11697-1 OPENSUSE-SU-2026:11700-1 OPENSUSE-SU-2026:11713-1 OPENSUSE-SU-2026:11718-1+66 more

Timeline

01-09-2026
PublishedVulnerability first disclosed.
01-09-2026
Last modifiedVulnerability information updated.

Description

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

CVSS metrics

7 scores · 7 sources · 1 version

v4.08.7

EPSS trend

Probability

0.61%

Chance of exploitation in the next 30 days

Percentile

49%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.61% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard200 products

aactl< 0.4.12-r74
agentbeat< 9.2.7-r28
agentbeat-fips< 9.2.7-r26
amass< 5.1.1-r16
amazon-cloudwatch-agent< 1.300073.0-r0 | < 1.300073.0-r1

amazon-cloudwatch-agent-fips< 1.300072.0-r6
amazon-cloudwatch-agent-operator< 3.7.0-r5
amazon-cloudwatch-agent-operator-fips< 3.7.0-r3
amazon-k8s-cni< 1.23.0-r4
amazon-k8s-cni-fips< 1.23.0-r5
amazon-k8s-cni-init-compat< 1.23.1-r0
amazon-ssm-agent< 3.3.5226.0-r2
amazon-ssm-agent-ecs-exec< 3.3.5226.0-r2
amazon-ssm-agent-ecs-exec-fips< 3.3.5226.0-r4
amazon-ssm-agent-fips< 3.3.5226.0-r4
ansible-operator< 1.42.3-r15
ansible-operator-fips< 1.42.3-r12
apache-beam-java-11-sdk< 2.76.0-r2
apache-beam-java-17-sdk< 2.76.0-r2
apache-beam-java-21-sdk< 2.76.0-r2
apache-beam-python-3.11-sdk< 2.76.0-r1
apache-beam-python-3.12-sdk< 2.76.0-r1
apache-beam-python-3.13-sdk< 2.76.0-r1
apache-beam-python-3.14-sdk< 2.76.0-r1
apiserver-network-proxy-0.34< 0.34.0-r8
apiserver-network-proxy-0.34-agent< 0.34.0-r8
apiserver-network-proxy-0.35< 0.35.0-r8
apiserver-network-proxy-0.35-agent< 0.35.0-r8
apiserver-network-proxy-0.36< 0.36.0-r8
apiserver-network-proxy-0.36-agent< 0.36.0-r8
apiserver-network-proxy-fips-0.34< 0.34.0-r11
apiserver-network-proxy-fips-0.34-agent< 0.34.0-r11
apiserver-network-proxy-fips-0.35< 0.35.0-r11
apiserver-network-proxy-fips-0.35-agent< 0.35.0-r11
apiserver-network-proxy-fips-0.36< 0.36.0-r11
apiserver-network-proxy-fips-0.36-agent< 0.36.0-r11
apisix-ingress-controller< 2.2.0-r4
apko< 1.2.43-r2
apko-fips< 1.2.40-r2
apm-server-8.19< 8.19.21-r3
apm-server-9.2< 9.2.8-r12 | < 9.2.8-r13
apm-server-9.3< 9.3.8-r5
apm-server-9.4< 9.4.6-r2
apm-server-9.5< 9.5.3-r1
apm-server-fips-8.19< 8.19.21-r2
apm-server-fips-9.2< 9.2.8-r13
apm-server-fips-9.3< 9.3.8-r5
apm-server-fips-9.4< 9.4.6-r1
apm-server-fips-9.5< 9.5.2-r3
apply-cve-bump< 0.2.343-r1 | < 0.2.344-r0
argo-cd-3.1All versions (No fix recorded)
argo-cd-3.1-compatAll versions (No fix recorded)
argo-cd-3.2< 3.2.12-r17
argo-cd-3.2-compat< 3.2.12-r17
argo-cd-3.3< 3.3.14-r7
argo-cd-3.3-compat< 3.3.14-r9 | < 3.3.14-r7 | All versions (No fix recorded)
argo-cd-3.4< 3.4.8-r1
argo-cd-3.4-compat< 3.4.8-r1
argo-cd-3.5< 3.5.2-r3
argo-cd-3.5-compat< 3.5.2-r3
argo-cd-fips-3.1All versions (No fix recorded)
argo-cd-fips-3.1-compatAll versions (No fix recorded)
argo-cd-fips-3.2All versions (No fix recorded)
argo-cd-fips-3.2-compatAll versions (No fix recorded)
argo-cd-fips-3.3< 3.3.14-r8
argo-cd-fips-3.3-compat< 3.3.14-r8
argo-cd-fips-3.4< 3.4.8-r5
argo-cd-fips-3.4-compat< 3.4.8-r5
argo-cd-fips-3.5< 3.5.2-r5
argo-cd-fips-3.5-compat< 3.5.2-r5
argo-events< 1.9.11-r8
argo-events-fips< 1.9.11-r10
argo-rollouts< 1.10.0-r1
argo-rollouts-fips< 1.9.1-r7
argo-workflow-controller-3.7All versions (No fix recorded)
argo-workflow-controller-4.0< 4.0.10-r4
argo-workflow-controller-4.1< 4.1.2-r6
argo-workflow-controller-fips-3.7All versions (No fix recorded)
argo-workflow-controller-fips-4.0< 4.0.10-r5
argo-workflow-controller-fips-4.1< 4.1.2-r4
argo-workflow-executor-3.7All versions (No fix recorded)
argo-workflow-executor-4.0< 4.0.10-r4
argo-workflow-executor-4.1< 4.1.2-r6
argo-workflow-executor-fips-3.7All versions (No fix recorded)
argo-workflow-executor-fips-4.0< 4.0.10-r5
argo-workflow-executor-fips-4.1< 4.1.2-r4
argo-workflows-3.7All versions (No fix recorded)
argo-workflows-4.0< 4.0.10-r4
argo-workflows-4.1< 4.1.2-r6
argo-workflows-fips-3.7All versions (No fix recorded)
argo-workflows-fips-4.0< 4.0.10-r5
argo-workflows-fips-4.1< 4.1.2-r4
argo-workflows-ui-4.0< 4.0.11-r0
argocd-image-updater< 1.3.0-r7
argocd-image-updater-fips< 1.3.0-r5
art< 0.2.344-r0
athenz-csi-driver< 0.0.16-r4
athenz-csi-driver-fips< 0.0.16-r4
atlas< 1.3.0-r6
atlas-fips< 1.3.0-r5
auditbeat-8.19< 8.19.21-r1
auditbeat-9.5< 9.5.3-r0
auditbeat-fips-8.19< 8.19.21-r1
auditbeat-fips-9.2All versions (No fix recorded)
auditbeat-fips-9.5< 9.5.2-r2
authservice< 1.1.8-r4
authservice-fips< 1.1.8-r4
aws-ebs-csi-driver-1.50< 1.50.3-r20
aws-ebs-csi-driver-1.51All versions (No fix recorded)
aws-ebs-csi-driver-1.52< 1.52.1-r22
aws-ebs-csi-driver-1.53< 1.53.0-r22
aws-ebs-csi-driver-1.54All versions (No fix recorded)
aws-ebs-csi-driver-1.55< 1.55.0-r18
aws-ebs-csi-driver-1.56< 1.56.0-r21
aws-ebs-csi-driver-1.57< 1.57.1-r15
aws-ebs-csi-driver-1.58< 1.58.0-r13
aws-ebs-csi-driver-1.59All versions (No fix recorded)
aws-ebs-csi-driver-1.60< 1.60.1-r12
aws-ebs-csi-driver-1.61All versions (No fix recorded)
aws-ebs-csi-driver-1.62< 1.62.0-r7
aws-ebs-csi-driver-1.63< 1.63.1-r5
aws-ebs-csi-driver-1.64< 1.64.0-r4
aws-ebs-csi-driver-fips-1.50All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.51< 1.51.2-r23
aws-ebs-csi-driver-fips-1.52< 1.52.1-r22
aws-ebs-csi-driver-fips-1.53All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.54< 1.54.0-r21
aws-ebs-csi-driver-fips-1.55All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.56All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.57< 1.57.1-r17 | < 1.57.1-r16
aws-ebs-csi-driver-fips-1.58< 1.58.0-r12
aws-ebs-csi-driver-fips-1.59< 1.59.0-r14
aws-ebs-csi-driver-fips-1.60< 1.60.1-r13
aws-ebs-csi-driver-fips-1.61All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.62< 1.62.0-r9
aws-ebs-csi-driver-fips-1.63All versions (No fix recorded)
aws-ebs-csi-driver-fips-1.64< 1.64.0-r3
aws-efs-csi-driver< 3.4.2-r3
aws-efs-csi-driver-fips< 3.4.2-r3
aws-fsx-csi-driver< 1.10.0-r5
aws-fsx-csi-driver-fips< 1.10.0-r4
aws-network-policy-agent< 1.4.2-r0
aws-network-policy-agent-fips< 1.4.2-r0
aws-otel-collector< 0.50.0-r3
aws-otel-collector-fips< 0.50.0-r3
azure-service-operator< 2.21.0-r2
azure-service-operator-fips< 2.21.0-r3
azure-vnet-cni< 1.8.7-r9
azuredisk-csi-1.33< 1.33.12-r0
azuredisk-csi-1.34< 1.34.5-r6
azuredisk-csi-fips-1.33< 1.33.12-r0
azuredisk-csi-fips-1.34< 1.34.5-r5
azurefile-csi-1.33< 1.33.10-r11
azurefile-csi-1.34< 1.34.9-r0
azurefile-csi-1.35< 1.35.7-r5
azurefile-csi-fips-1.33< 1.33.10-r11
azurefile-csi-fips-1.34< 1.34.9-r0
azurefile-csi-fips-1.35< 1.35.8-r0
backup-restore-operator-10.0< 10.0.9-r2
backup-restore-operator-11.0< 11.0.2-r2
backup-restore-operator-7.0< 7.0.10-r3
backup-restore-operator-8.1< 8.1.8-r1
backup-restore-operator-9.0< 9.0.7-r2
backup-restore-operator-fips-10.0< 10.0.9-r3
backup-restore-operator-fips-11.0< 11.0.2-r3
backup-restore-operator-fips-7.0< 7.0.10-r3
backup-restore-operator-fips-8.1< 8.1.8-r3
backup-restore-operator-fips-9.0< 9.0.7-r3
bank-vaults< 1.33.2-r2
bank-vaults-fips< 1.33.2-r2
bank-vaults-template< 1.33.2-r3 | < 1.33.2-r2 | All versions (No fix recorded)
bank-vaults-template-fips< 1.33.2-r2
bank-vaults-vault-operator< 1.24.0-r9
bank-vaults-vault-operator-fips< 1.24.0-r9
bento< 1.21.1-r5
bento-fips< 1.21.1-r7
blob-csi-1.23< 1.23.11-r83
blob-csi-1.24< 1.24.11-r31
blob-csi-1.25< 1.25.10-r30
blob-csi-1.26< 1.26.17-r0
blob-csi-1.27< 1.27.10-r0 | < 1.27.9-r5
blob-csi-fips-1.23< 1.23.11-r86
blob-csi-fips-1.24< 1.24.11-r32
blob-csi-fips-1.25< 1.25.10-r28
blob-csi-fips-1.26< 1.26.17-r0
blob-csi-fips-1.27< 1.27.9-r3
boring-registry< 0.19.0-r6
boring-registry-fips< 0.19.0-r5
buildah< 1.45.0-r6
buildah-fips< 1.45.0-r4
buildctl-fips< 0.33.0-r0
buildkite-agent-fips< 4.0.1-r0
caddy< 2.11.4-r11
caddy-fips< 2.11.4-r11
cadence< 1.4.1-r13
cadence-cassandra-tool< 1.4.1-r13
cadence-fips< 1.4.1-r13
cadence-fips-cassandra-tool< 1.4.1-r13
cadence-fips-server< 1.4.1-r13
cadence-fips-sql-tool< 1.4.1-r13

Show all 200

1 vendor · 200 products · Showing 200 of 4254

References

14 links

github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qcX Refsource CONFIRMREPORTAdvisoryWEB
github.com/grpc/grpc-go/pull/9331X Refsource MISCREPORTFIXWEB
github.com/grpc/grpc-go/pull/9333X Refsource MISCREPORTFIXWEB
github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176X Refsource MISCFIXWEB
github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77X Refsource MISCFIXWEB
github.com/grpc/grpc-go/releases/tag/v1.83.1X Refsource MISCWEB
ubuntu.com/security/CVE-2026-84304REPORT
www.cve.org/CVERecord?id=CVE-2026-84304REPORT
security-tracker.debian.org/tracker/CVE-2026-84304Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84304.jsonAdvisory

Show all 14 references

nvd.nist.gov/vuln/detail/CVE-2026-84304AdvisoryOval
github.com/grpc/grpc-goPACKAGE
www.suse.com/security/cve/CVE-2026-84304WEB
bugzilla.suse.com/1279216REPORT