CVE-2026-84304
Received Received - Intake

Heap Exhaustion in gRPC-Go via Fragmented Frames

Publication date: 2026-09-01

Last updated on: 2026-09-01

Assigner: GitHub, Inc.

Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-01
Last Modified
2026-09-01
Generated
2026-09-02
AI Q&A
2026-09-01
EPSS Evaluated
N/A
NVD
CVE-2026-84304
EUVD
EUVD-2026-69420

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
grpc grpc-go 1.83.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-400 The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in gRPC-Go before version 1.83.1 allows an unauthenticated remote attacker to exhaust process memory by sending millions of small fragmented HTTP/2 DATA frames. Each frame is stored separately in memory, consuming disproportionate heap resources even when total payload remains within flow-control limits.

Detection Guidance

Monitor for excessive memory usage or runtime panics in gRPC-Go applications. Check for millions of fragmented HTTP/2 DATA frames by inspecting network traffic with tools like Wireshark or tcpdump. Enable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION to observe compaction behavior.

Impact Analysis

An attacker could cause a denial of service by crashing the application or triggering out-of-memory termination. This affects any system using vulnerable gRPC-Go versions, potentially disrupting services relying on gRPC communication.

Compliance Impact

This vulnerability could indirectly impact compliance with GDPR and HIPAA by enabling denial-of-service attacks that disrupt service availability. GDPR requires ensuring availability of processing systems, while HIPAA mandates safeguards against disruptions. Exploits causing runtime panics or OOM terminations may violate these requirements by degrading or disabling critical services handling sensitive data.

Mitigation Strategies

Upgrade gRPC-Go to version 1.83.1 or later. If immediate upgrade is not possible, set GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=0 to disable receive-buffer compaction temporarily. Monitor memory usage and limit concurrent streams to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-84304. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart