Skip to content
Fencer Vulns
high 8.7

CVE-2026-84304 json

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

published 2026-09-01 2 mo ago modified 2026-09-15 54 d ago also GHSA-vp52-pcj8-j9qc , GO-2026-6348 , EUVD-2026-69420

cvss
8.7
version 4.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 49%
public exploits
0
none known

Summary

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

Patch / fix

  • go google.golang.org/grpc 1.83.1
  • terraform-provider-aws SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.11.0-150200.6.29.2
  • terraform-provider-tls SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.5.26.2
  • terraform-provider-helm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.9.0-150200.6.34.2
  • terraform-provider-null SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.32.2
  • terraform-provider-local SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.0.0-150200.6.30.2
  • terraform-provider-google SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.43.0-150200.6.23.2
  • terraform-provider-random SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 3.0.0-150200.6.26.2
  • terraform-provider-azurerm SLE Module for Public Cloud 15 SP5, SLE Module for Public Cloud 15 SP4 2.32.0-150200.6.23.2

suse advisories SUSE-SU-2026:4628-1SUSE-SU-2026:24213-1SUSE-SU-2026:24150-1SUSE-SU-2026:4444-1SUSE-SU-2026:4392-1SUSE-SU-2026:4389-1

  • rqlite openSUSE Leap 16.0 10.6.6-bp160.1.1
  • containerd openSUSE Tumbleweed 2.4.2-1.1
  • kubevirt1.8 openSUSE Tumbleweed 1.8.4-7.1
  • tekton-cli openSUSE Tumbleweed 0.46.2-1.1
  • gh openSUSE Leap 16.0 2.102.0-bp160.1.1
  • coredns openSUSE Leap 16.0 1.14.7-bp160.2.1
  • rqlite openSUSE Tumbleweed 10.6.1-1.1
  • gh openSUSE Tumbleweed 2.102.0-1.1

opensuse advisories openSUSE-SU-2026:22224-1openSUSE-SU-2026:12342-1openSUSE-SU-2026:12241-1openSUSE-SU-2026:12253-1openSUSE-SU-2026:22134-1openSUSE-SU-2026:22135-1

  • azcopy Azure Linux 3.0 10.25.1-9
  • azurelinux-image-tools Azure Linux 3.0 1.6.0-3
  • containerd2 Azure Linux 3.0 2.3.7-1
  • containerized-data-importer Azure Linux 3.0 1.62.0-8
  • coredns Azure Linux 3.0 1.11.4-21
  • cri-tools Azure Linux 3.0 1.32.0-10
  • docker-buildx Azure Linux 3.0 0.14.0-19
  • docker-compose Azure Linux 3.0 2.27.0-15

azure linux advisories AZL-99150AZL-99153AZL-99180AZL-99183AZL-99186AZL-99189

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-84304 updated cvss 7.5

google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation

  • Red Hat Multicluster Engine for Kubernetes multicluster-engine/work-rhel9, multicluster-engine/placement-rhel9, multicluster-engine/registration-rhel9, multicluster-engine/addon-manager-rhel9, multicluster-engine/assisted-service-9-rhel9, multicluster-engine/multicloud-manager-rhel9, +2 more Red Hat OpenShift Pipelines openshift-pipelines/pipelines-cli-tkn-rhel9, openshift-pipelines/pipelines-resolvers-rhel9, openshift-pipelines/pipelines-results-api-rhel9, openshift-pipelines/pipelines-results-watcher-rhel9, openshift-pipelines/pipelines-triggers-webhook-rhel9, openshift-pipelines/pipelines-chains-controller-rhel9, +6 more Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/kube-rbac-proxy-rhel9
    affected: workaround, no fix available
  • Red Hat Hardened Images opentofu1.11 1.11.14-0.1.hum1
    affected: workaround, no fix planned “Will not fix”
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mod-arch-gen-ai-rhel9, rhoai/odh-workbenches-operator-rhel9, rhoai/odh-model-registry-operator-rhel9, rhoai/odh-kuberay-operator-controller-rhel9 Red Hat OpenShift Container Platform 4 openshift4/ose-kube-rbac-proxy-rhel9 Red Hat OpenShift Container Platform 5 openshift5/ose-kube-rbac-proxy-rhel9 Red Hat OpenShift distributed tracing 3 rhosdt/opentelemetry-rhel9-operator, rhosdt/opentelemetry-collector-rhel9
    affected: workaround, no fix available
  • Red Hat Cert Manager support for Red Hat OpenShift release 1.17 cert-manager/cert-manager-operator-rhel9 1791788287, cert-manager/jetstack-cert-manager-rhel9 1791371069, cert-manager/jetstack-cert-manager-acmesolver-rhel9 1791371080
    fixed: vendor fix RHSA-2026:82322
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/prometheus-rhel9 1793662399, cluster-observability-operator/prometheus-rhel9 1793822854, cluster-observability-operator/obo-prometheus-rhel9-operator 1793661150, cluster-observability-operator/obo-prometheus-rhel9-operator 1793823694, cluster-observability-operator/cluster-observability-rhel9-operator 1793662110, cluster-observability-operator/cluster-observability-rhel9-operator 1793847117
    fixed: vendor fix RHSA-2026:95591
  • Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/cluster-logging-rhel9-operator 1793051087
    fixed: vendor fix RHSA-2026:92515
  • Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/kube-rbac-proxy-mce-rhel9 1793020034
    fixed: vendor fix RHSA-2026:92303
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/multicloud-integrations-rhel9 1792847819, rhacm2/multicluster-operators-channel-rhel9 1792906953, rhacm2/multicluster-observability-rhel9-operator 1793032994, rhacm2/multicluster-operators-subscription-rhel9 1792886460
    fixed: vendor fix RHSA-2026:92307
show 8 more
  • Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-main-rhel9 1791396165, advanced-cluster-security/rhacs-rhel9-operator 1791396165, advanced-cluster-security/rhacs-scanner-v4-rhel9 1791396165, advanced-cluster-security/rhacs-scanner-slim-rhel9 1790747681
    fixed: vendor fix RHSA-2026:79575
  • Red Hat OpenShift Builds 1.9.2 openshift-builds/openshift-builds-operator-bundle 1792762900, openshift-builds/openshift-builds-rhel10-operator 1792749358, openshift-builds/openshift-builds-rhel10-operator 1792859629
    fixed: fixed in 1.9.2 RHSA-2026:89041
  • Red Hat Cluster Observability Operator 1.5 cluster-observability-operator/perses-rhel9 1793661985, cluster-observability-operator/perses-rhel9 1793825744, cluster-observability-operator/thanos-rhel9 1793660568, cluster-observability-operator/thanos-rhel9 1793821585, cluster-observability-operator/korrel8r-rhel9 1793661297, cluster-observability-operator/korrel8r-rhel9 1793822079, +38 more Red Hat Logging Subsystem for Red Hat OpenShift 6.6 openshift-logging/vector-rhel9 1793051738, openshift-logging/eventrouter-rhel9 1792998256, openshift-logging/logging-loki-rhel9 1793041359, openshift-logging/loki-rhel9-operator 1793051099, openshift-logging/opa-openshift-rhel9 1793051110, openshift-logging/loki-operator-bundle 1793055216, +3 more Red Hat multicluster engine for Kubernetes 2.8 multicluster-engine/hive-rhel9 1793055767, multicluster-engine/work-rhel9 1792867410, multicluster-engine/discovery-rhel9 1792864323, multicluster-engine/placement-rhel9 1792887454, multicluster-engine/console-mce-rhel9 1792886718, multicluster-engine/must-gather-rhel9 1792838494, +20 more
    not affected: vulnerable code not present
  • Red Hat Advanced Cluster Management for Kubernetes 2 rhacm2/cert-policy-controller-rhel9, rhacm2/config-policy-controller-rhel9, rhacm2/governance-policy-propagator-rhel9, rhacm2/acm-governance-policy-framework-addon-rhel9, rhacm2/acm-governance-policy-addon-controller-rhel9
    not affected: vulnerable code not in execute path
  • Red Hat Advanced Cluster Management for Kubernetes 2.13 rhacm2/thanos-rhel9 1792872550, rhacm2/acm-cli-rhel9 1792972427, rhacm2/console-rhel9 1792883111, rhacm2/prometheus-rhel9 1792853139, rhacm2/acm-grafana-rhel9 1792865487, rhacm2/acm-search-v2-rhel9 1792847370, +34 more Red Hat Advanced Cluster Security for Kubernetes 4.11 advanced-cluster-security/rhacs-fact-rhel9 1790133502, advanced-cluster-security/rhacs-roxctl-rhel9 1791396165, advanced-cluster-security/rhacs-scanner-rhel9 1790747681, advanced-cluster-security/rhacs-collector-rhel9 1790320857, advanced-cluster-security/rhacs-operator-bundle 1791396165, advanced-cluster-security/rhacs-central-db-rhel9 1791396165, +3 more
    not affected: vulnerable code not present
  • Red Hat Hardened Images dex 2.45.1-1.hum1, etcd 3.7.2-0.1.hum1, k6v1 1.8.1-0.1.hum1, k6v2 2.3.0-0.1.hum1, helm4 4.3.0-0.2.hum1, rekor 1.5.4-0.1.hum1, +36 more
    not affected: component not present
  • Red Hat OpenShift AI (RHOAI) rhoai/odh-mlflow-operator-rhel9 Red Hat OpenShift Builds 1.9.2 openshift-builds/openshift-builds-waiters-rhel10 1792762119, openshift-builds/openshift-builds-waiters-rhel10 1792839475, openshift-builds/openshift-builds-webhook-rhel10 1792680944, openshift-builds/openshift-builds-webhook-rhel10 1792835571, openshift-builds/openshift-builds-operator-bundle 1792863311, openshift-builds/openshift-builds-controller-rhel10 1792680723, +11 more
    not affected: vulnerable code not present
  • Red Hat OpenShift Container Platform 4 openshift4/ose-kube-rbac-proxy, openshift4/ose-vertical-pod-autoscaler-rhel9-operator Red Hat OpenShift Container Platform 5 openshift5/ose-vertical-pod-autoscaler-rhel9-operator
    not affected: vulnerable code not in execute path

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
2 mo ago

Exploit prediction

0.61% chance of exploitation in the next 30 days, higher than 49% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
CNA 4.0 8.7 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Affected packages

ecosystem package affected fixed in
go google.golang.org/grpc
<1.83.1
1.83.1

Affected products

  • grpc grpc-go

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.