CVE-2026-84304
Vulnerability Summary
Timeline
Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
CVSS Metrics
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
- v4.0•HIGH•Score: 8.7CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Trends
Current EPSS score: 0.41%• Percentile: 35%
Techniques & Countermeasures
- CWE-400•Uncontrolled Resource Consumption
The product does not properly control the allocation and maintenance of a limited resource.
Affected Systems
- chainguard•aactl
< 0.4.12-r74
- chainguard•agentbeat
< 9.2.7-r28
- chainguard•agentbeat-fips
< 9.2.7-r26
- chainguard•amass
< 5.1.1-r16
- chainguard•amazon-cloudwatch-agent
< 1.300073.0-r0 | < 1.300073.0-r1
- chainguard•amazon-cloudwatch-agent-fips
< 1.300072.0-r6
- chainguard•amazon-cloudwatch-agent-operator
< 3.7.0-r5
- chainguard•amazon-cloudwatch-agent-operator-fips
< 3.7.0-r3
- chainguard•amazon-k8s-cni
< 1.23.0-r4
- chainguard•amazon-k8s-cni-fips
< 1.23.0-r5
- chainguard•amazon-k8s-cni-init-compat
< 1.23.1-r0
- chainguard•amazon-ssm-agent
< 3.3.5226.0-r2
- chainguard•amazon-ssm-agent-ecs-exec
< 3.3.5226.0-r2
- chainguard•amazon-ssm-agent-ecs-exec-fips
all | < 3.3.5226.0-r4
- chainguard•amazon-ssm-agent-fips
all | < 3.3.5226.0-r4
- chainguard•ansible-operator
< 1.42.3-r15
- chainguard•ansible-operator-fips
< 1.42.3-r12
- chainguard•apache-beam-java-11-sdk
< 2.76.0-r2
- chainguard•apache-beam-java-17-sdk
< 2.76.0-r2
- chainguard•apache-beam-java-21-sdk
< 2.76.0-r2
- chainguard•apache-beam-python-3.11-sdk
< 2.76.0-r1
- chainguard•apache-beam-python-3.12-sdk
< 2.76.0-r1
- chainguard•apache-beam-python-3.13-sdk
< 2.76.0-r1
- chainguard•apache-beam-python-3.14-sdk
< 2.76.0-r1
- chainguard•apiserver-network-proxy-0.34
< 0.34.0-r8
- chainguard•apiserver-network-proxy-0.34-agent
< 0.34.0-r8
- chainguard•apiserver-network-proxy-0.35
< 0.35.0-r8
- chainguard•apiserver-network-proxy-0.35-agent
< 0.35.0-r8
- chainguard•apiserver-network-proxy-0.36
< 0.36.0-r8
- chainguard•apiserver-network-proxy-0.36-agent
< 0.36.0-r8
- chainguard•apiserver-network-proxy-fips-0.34
< 0.34.0-r11
- chainguard•apiserver-network-proxy-fips-0.34-agent
< 0.34.0-r11
- chainguard•apiserver-network-proxy-fips-0.35
< 0.35.0-r11
- chainguard•apiserver-network-proxy-fips-0.35-agent
< 0.35.0-r11
- chainguard•apiserver-network-proxy-fips-0.36
< 0.36.0-r11
- chainguard•apiserver-network-proxy-fips-0.36-agent
< 0.36.0-r11
- chainguard•apisix-ingress-controller
< 2.2.0-r4
- chainguard•apko
< 1.2.43-r2
- chainguard•apko-fips
< 1.2.40-r2
- chainguard•apm-server-8.19
< 8.19.21-r3
- chainguard•apm-server-9.2
< 9.2.8-r12 | < 9.2.8-r13
- chainguard•apm-server-9.3
< 9.3.8-r5
- chainguard•apm-server-9.4
< 9.4.6-r2
- chainguard•apm-server-9.5
< 9.5.3-r1
- chainguard•apm-server-fips-8.19
< 8.19.21-r2
- chainguard•apm-server-fips-9.2
< 9.2.8-r13
- chainguard•apm-server-fips-9.3
< 9.3.8-r5
- chainguard•apm-server-fips-9.4
< 9.4.6-r1
- chainguard•apm-server-fips-9.5
< 9.5.2-r3
- chainguard•apply-cve-bump
< 0.2.343-r1 | < 0.2.344-r0
Showing first 50 affected entries in server-rendered view.
References (13)
- https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc
- https://github.com/grpc/grpc-go/pull/9331
- https://github.com/grpc/grpc-go/pull/9333
- https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176
- https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77
- https://github.com/grpc/grpc-go/releases/tag/v1.83.1
- https://security-tracker.debian.org/tracker/CVE-2026-84304
- https://nvd.nist.gov/vuln/detail/CVE-2026-84304
- https://github.com/grpc/grpc-go
- https://ubuntu.com/security/CVE-2026-84304
- https://www.cve.org/CVERecord?id=CVE-2026-84304
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/84xxx/CVE-2026-84304.json
- https://www.suse.com/security/cve/CVE-2026-84304