CVE-2026-84304: gRPC-Go Heap Memory Exhaustion (OOM) Vulnerability

Q: What is CVE-2026-84304?

CVE-2026-84304 is a security vulnerability in gRPC-Go involving Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation under CWE-400: Uncontrolled Resource Consumption.

Q: Which gRPC-Go versions are affected?

Affected versions include releases prior to 1.83.1 across affected packages: google.golang.org/grpc.

Q: What version fixes CVE-2026-84304?

Upgrading to 1.83.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Q: Is google.golang.org/grpc affected?

Yes, google.golang.org/grpc is affected in releases prior to 1.83.1. Upgrade your dependency to 1.83.1 or later.

Q: What CWE is associated with CVE-2026-84304?

CVE-2026-84304 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).

Q: How can I check Go dependencies for CVE-2026-84304?

Run the dependency tree command: 'inspect dependencies for google.golang.org/grpc'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

HIGH

Advisory Identifier: GHSA-vp52-pcj8-j9qc

CWE-400

Published 2026-09-01

Advisory Summary

CVE-2026-84304 is a HIGH heap memory exhaustion (oom) vulnerability (CWE-400: Uncontrolled Resource Consumption) affecting gRPC-Go libraries in the Go ecosystem. The issue involves heap memory exhaustion (oom) via http/2 data frame fragmentation. Remediation is available by upgrading affected packages to version 1.83.1.

CVE-2026-84304 at a Glance

CVE Identifier CVE-2026-84304

GHSA Identifier GHSA-vp52-pcj8-j9qc

Severity HIGH

CVSS v3.1 Base Score N/A

CWE Classification CWE-400: Uncontrolled Resource Consumption

Affected Product gRPC-Go

Package Ecosystem Go

Published Date 2026-09-01

Last Updated 2026-09-01

How to Fix CVE-2026-84304

To remediate this vulnerability, upgrade all affected gRPC-Go dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

google.golang.org/grpc fixed: 1.83.1

Upgrade google.golang.org/grpc to 1.83.1

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release:

inspect dependencies for google.golang.org/grpc

How to Check if You Are Affected

To determine whether your application is affected by CVE-2026-84304, inspect your project dependencies for gRPC-Go:

inspect dependencies for google.golang.org/grpc

Analyze the terminal output to locate any version of gRPC-Go in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 1.83.1), your application is affected.

Note: Verify declared build manifests and deployed runtime container environments.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-400: Uncontrolled Resource Consumption, where the product does not properly control the allocation and maintenance of a limited resource. In gRPC-Go, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

### Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation. Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS). ### Patches The change to fix this issue is merged in `master` and a patch release, 1.83.1, has been published that contains this fix. ### Workarounds This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads. This behavior is enabled by default. A temporary escape hatch is provided via the environment variable `GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false` to disable the feature if unforeseen issues arise, but it will be removed in a future release.

CVE-2026-84304 Affected gRPC-Go Versions

1 component(s)

Fixed Versions:

1.83.1

Product / Package	Ecosystem	Affected Versions	Fixed Version
google.golang.org/grpc golang/google.golang.org/grpc	Go	< 1.83.1	1.83.1

References

GitHub Advisory / Wiki ADVISORY

https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc

NVD — CVE-2026-84304 NVD

https://nvd.nist.gov/vuln/detail/CVE-2026-84304

gRPC-Go Source Repository REPOSITORY

https://github.com/grpc/grpc-go/pull/9331

gRPC-Go Source Repository REPOSITORY

https://github.com/grpc/grpc-go/pull/9333

Security Fix Commit FIX COMMIT

https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176

Security Fix Commit FIX COMMIT

https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77

gRPC-Go Source Repository REPOSITORY

https://github.com/grpc/grpc-go

gRPC-Go Release RELEASE

https://github.com/grpc/grpc-go/releases/tag/v1.83.1

Frequently Asked Questions

What is CVE-2026-84304?

CVE-2026-84304 is a security vulnerability in gRPC-Go involving Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation under CWE-400: Uncontrolled Resource Consumption.

Which gRPC-Go versions are affected?

Affected versions include releases prior to 1.83.1 across affected packages: google.golang.org/grpc.

What version fixes CVE-2026-84304?

Upgrading to 1.83.1 (or the latest patched release for your respective branch) resolves the vulnerability.

Is google.golang.org/grpc affected?

Yes, google.golang.org/grpc is affected in releases prior to 1.83.1. Upgrade your dependency to 1.83.1 or later.

What CWE is associated with CVE-2026-84304?

CVE-2026-84304 is classified under CWE-400: Uncontrolled Resource Consumption (The product does not properly control the allocation and maintenance of a limited resource.).

How can I check Go dependencies for CVE-2026-84304?

Run the dependency tree command: 'inspect dependencies for google.golang.org/grpc'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.

Machine-readable OSV JSON OSV v1.5 Schema

Normalized schema output

View Raw JSON

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-vp52-pcj8-j9qc",
  "modified" : "2026-09-01T21:32:41Z",
  "published" : "2026-09-01T21:32:41Z",
  "aliases" : [ "CVE-2026-84304" ],
  "summary" : "gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation",
  "details" : "### Impact\nAn unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.\n\nRepeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).\n\n### Patches\nThe change to fix this issue is merged in `master` and a patch release, 1.83.1, has been published that contains this fix.\n\n### Workarounds\nThis vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.\n\nThis behavior is enabled by default. A temporary escape hatch is provided via the environment variable `GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false` to disable the feature if unforeseen issues arise, but it will be removed in a future release.",
  "severity" : [ {
    "type" : "CVSS_V4",
    "score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Go",
      "name" : "google.golang.org/grpc"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "1.83.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 1.83.0"
    }
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-84304"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/pull/9331"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/pull/9333"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/grpc/grpc-go"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/grpc/grpc-go/releases/tag/v1.83.1"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400" ],
    "severity" : "HIGH",
    "github_reviewed" : true,
    "github_reviewed_at" : "2026-09-01T21:32:41Z",
    "nvd_published_at" : "2026-09-01T19:17:30Z"
  }
}

CVSS V4

N/A HIGH

Attack Vector N/A

Attack Complexity N/A

Privileges Required N/A

User Interaction N/A

Scope N/A

Confidentiality N/A

Integrity N/A

Availability N/A

Vector String

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Advisory Metadata

Source ID: GHSA-vp52-pcj8-j9qc
Schema Version: 1.4.0
Published: 2026-09-01 21:32
Last Modified: 2026-09-01 21:32
Database Record File: advisories/github-reviewed/2026/09/GHSA-vp52-pcj8-j9qc/GHSA-vp52-pcj8-j9qc.json