CVE-2026-84304 gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
An unauthenticated remote attacker can exhaust memory via fragmented HTTP/2 frames, causing denial of service in applications using gRPC-Go.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-84304?
CVE-2026-84304 is a high-severity denial of service vulnerability in grpc-go, published on 1 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Weakness: CWE-400
Which versions are affected by CVE-2026-84304?
3 open source packages ship an affected version, including google.golang.org/grpc.
| Package | Affected | Fixed in |
|---|---|---|
google.golang.org/grpc Go | All versions | 1.83.1 |
google.golang.org/grpc Go | All versions | 1.83.1 |
google.golang.org/grpc Go | All versions | 1.83.1 |
Linux distribution packages (5)
coredns openSUSE:Leap 16.0 | All versions | 1.14.7-bp160.2.1 |
coredns openSUSE:Tumbleweed | All versions | 1.14.7-3.1 |
google-guest-agent openSUSE:Tumbleweed | All versions | 20260903.01-1.1 |
kubectl-cnpg openSUSE:Tumbleweed | All versions | 1.30.1-1.1 |
prometheus-blackbox_exporter openSUSE:Tumbleweed | All versions | 0.26.0-9.1 |
How do I fix CVE-2026-84304?
Upgrade google.golang.org/grpc to 1.83.1 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-84304 being exploited?
There is no known exploitation of CVE-2026-84304 in the wild and no public exploit code.
Sources
Also known as AZL-99099, AZL-99119, AZL-99132, AZL-99138, AZL-99140, AZL-99150 and 1438 more.