highVulnerability
CVE-2026-84304
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Properties
- severity
- high
- summary
- gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
- epss_score
- 0.00609
- retrieved_at
- 2026-10-17T06:48:26+00:00
- ghsa_published
- 2026-09-01T21:32:41Z
- source_url
- https://github.com/advisories/GHSA-vp52-pcj8-j9qc
- ghsa_updated
- 2026-09-01T21:32:45Z
- ghsa_id
- GHSA-vp52-pcj8-j9qc
- last_source
- FIRST EPSS
- cve_id
- CVE-2026-84304
- signal_observed_at
- 2026-09-11T17:55:57+00:00
- is_ghsa_only
- false
- published_at
- 2026-09-01T19:17:30.743
- last_modified
- 2026-09-09T21:09:13.080
- epss_percentile
- 0.48034
Related Entities (6)
DESCRIBED_BY (1)
→[Source]NVD
ENRICHED_BY (1)
→[Source]FIRST EPSS
VULNERABLE_TO (1)
←[Software]go/google.golang.org/grpc
AFFECTS (1)
→[Software]go/google.golang.org/grpc
HAS_WEAKNESS (1)
→[Weakness]Uncontrolled Resource Consumption
REPORTED_BY (1)
→[Source]GitHub Advisory Database
Explore deeper with Ninja Signal's threat intelligence graph