Read the docs
TI-2026-57939 Aliases CVE-2026-84304GHSA-vp52-pcj8-j9qc

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Priority LOW 39CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 7 fixed, 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00609 49th percentileScored 2026-11-07
Fix Partial grpc-go (grpc): 1.83.1google.golang.org/grpc (Go): 1.83.1Red Hat: 11 advisoriesRed Hat: 7 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
grpcgrpc-gobefore 1.83.11.83.1Patch availableCNA
—google.golang.org/grpc (Go)before 1.83.11.83.1Patch availableGHSA-vp52-pcj8-j9qc
  • grpc-go Vendorgrpc Affected before 1.83.1 Fixed in 1.83.1 Patch available CNA
  • google.golang.org/grpc (Go) Vendor— Affected before 1.83.1 Fixed in 1.83.1 Patch available GHSA-vp52-pcj8-j9qc

Remediation

  • Fix · CNA grpc-go (grpc) Fixed in 1.83.1
  • Fix · GHSA-vp52-pcj8-j9qc google.golang.org/grpc (Go) Fixed in 1.83.1 Advisory →

Red Hat 11 advisories

  • RHSA-2026:95591 Released 2026-11-05 · Red Hat rating Important
    Cluster Observability Operator - 1.5
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
  • RHSA-2026:95081 Released 2026-11-04 · Red Hat rating Important
    Cluster Observability Operator - 1.5
    • Cluster Observability Operator 1.5 registry.redhat.io/cluster-observability-operator/alertmanager-rhel9, registry.redhat.io/cluster-observability-operator/cluster-observability-rhel9-operator, registry.redhat.io/cluster-observability-operator/distributed-tracing-console-plugin-pf4-rhel9 +16
  • RHSA-2026:92593 Released 2026-10-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.2
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
Show 8 more Red Hat advisories
  • RHSA-2026:92515 Released 2026-10-29 · Red Hat rating Important
    Logging for Red Hat OpenShift - 6.6.2
    • Logging Subsystem for Red Hat OpenShift 6.6 registry.redhat.io/openshift-logging/cluster-logging-rhel9-operator, registry.redhat.io/openshift-logging/logging-loki-rhel9, registry.redhat.io/openshift-logging/loki-rhel9-operator +2
  • RHSA-2026:92307 Released 2026-10-29 · Red Hat rating Important
    Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update
    • Red Hat Advanced Cluster Management for Kubernetes 2.13 registry.redhat.io/rhacm2/acm-grafana-rhel9, registry.redhat.io/rhacm2/acm-multicluster-observability-addon-rhel9, registry.redhat.io/rhacm2/acm-prometheus-config-reloader-rhel9 +16
  • RHSA-2026:92303 Released 2026-10-29 · Red Hat rating Important
    multicluster engine for Kubernetes v2.8.12 security update
    • multicluster engine for Kubernetes 2.8 registry.redhat.io/multicluster-engine/addon-manager-rhel9, registry.redhat.io/multicluster-engine/backplane-rhel9-operator, registry.redhat.io/multicluster-engine/cluster-curator-controller-rhel9 +12
  • RHSA-2026:89131 Released 2026-10-24 · Red Hat rating Critical
    Red Hat OpenShift Builds 1.9.2
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +6
  • RHSA-2026:89041 Released 2026-10-24 · Red Hat rating Important
    Red Hat OpenShift Builds 1.9.2
    • Red Hat OpenShift Builds 1.9.2 registry.redhat.io/openshift-builds/openshift-builds-controller-rhel10, registry.redhat.io/openshift-builds/openshift-builds-git-cloner-rhel10, registry.redhat.io/openshift-builds/openshift-builds-image-bundler-rhel10 +7
  • RHSA-2026:82322 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/cert-manager-operator-rhel9
  • RHSA-2026:82304 Released 2026-10-13 · Red Hat rating Important
    cert-manager Operator for Red Hat OpenShift 1.17.2
    • Cert Manager support for Red Hat OpenShift release 1.17 registry.redhat.io/cert-manager/jetstack-cert-manager-acmesolver-rhel9, registry.redhat.io/cert-manager/jetstack-cert-manager-rhel9
  • RHSA-2026:79575 Released 2026-10-08 · Red Hat rating Important
    RHACS 4.11.5 security and bug fix update
    • Red Hat Advanced Cluster Security for Kubernetes 4.11 registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9, registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle, registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator +4

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Multicluster Engine for KubernetesAffectedNo fix yet
OpenShift PipelinesAffectedNo fix yet
Red Hat Advanced Cluster Management for Kubernetes 2AffectedNo fix yet
Red Hat Hardened ImagesAffectedNo fix planned: Will not fix
Red Hat OpenShift AI (RHOAI)AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat OpenShift Container Platform 5AffectedNo fix yet
Red Hat OpenShift distributed tracing 3AffectedNo fix yet
Cert Manager support for Red Hat OpenShift release 1.17Fixed RHSA-2026:82304, RHSA-2026:82322
Cluster Observability Operator 1.5Fixed RHSA-2026:95081, RHSA-2026:95591
Logging Subsystem for Red Hat OpenShift 6.6Fixed RHSA-2026:92515
Red Hat Advanced Cluster Management for Kubernetes 2.13Fixed RHSA-2026:92307
Red Hat Advanced Cluster Security for Kubernetes 4.11Fixed RHSA-2026:79575
Red Hat OpenShift Builds 1.9.2Fixed RHSA-2026:89041, RHSA-2026:89131
multicluster engine for Kubernetes 2.8Fixed RHSA-2026:92303
Not affected: 10 products
  • Cluster Observability Operator 1.5
  • Logging Subsystem for Red Hat OpenShift 6.6
  • Red Hat Advanced Cluster Management for Kubernetes 2
  • Red Hat Advanced Cluster Management for Kubernetes 2.13
  • Red Hat Advanced Cluster Security for Kubernetes 4.11
  • Red Hat Hardened Images
  • Red Hat OpenShift Builds 1.9.2
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Platform 5
  • multicluster engine for Kubernetes 2.8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-84304
  2. 2026-10-03 Alias added: GHSA-vp52-pcj8-j9qc
  3. 2026-10-06 Affected versions changed · Red Hat
  4. 2026-10-06 CVSS score added · Red Hat
  5. 2026-10-09 Fix available: RHSA-2026:79575 · Red Hat
  6. 2026-10-09 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  7. 2026-10-10 Affected versions changed · Red Hat
  8. 2026-10-13 Affected versions changed · Red Hat
  9. 2026-10-14 Fix available: RHSA-2026:82304 · Red Hat
  10. 2026-10-14 Fix available: RHSA-2026:82322 · Red Hat
  11. 2026-10-15 Fix available: Cert Manager support for Red Hat OpenShift release 1.17 · Red Hat
  12. 2026-10-22 Fix available: Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 · Red Hat
  13. 2026-10-25 Fix available: RHSA-2026:89131 · Red Hat
  14. 2026-10-25 Fix available: RHSA-2026:89041 · Red Hat
  15. 2026-10-25 Fix available: Red Hat OpenShift Builds 1.9.2 · Red Hat
  16. 2026-10-30 Fix available: RHSA-2026:92303 · Red Hat
  17. 2026-10-30 Fix available: RHSA-2026:92307 · Red Hat
  18. 2026-10-30 Fix available: Red Hat Advanced Cluster Management for Kubernetes 2.13, multicluster engine for Kubernetes 2.8 · Red Hat
  19. 2026-10-30 Affected versions changed · Red Hat
  20. 2026-10-30 Fix available: Logging Subsystem for Red Hat OpenShift 6.6 · Red Hat
  21. 2026-10-31 Fix available: RHSA-2026:92593 · Red Hat
  22. 2026-10-31 Fix available: RHSA-2026:92515 · Red Hat
  23. 2026-11-03 Fix available: Red Hat Advanced Cluster Security for Kubernetes 4.11 · Red Hat
  24. 2026-11-04 Fix available: RHSA-2026:95081 · Red Hat
  25. 2026-11-04 Fix available: Cluster Observability Operator 1.5 · Red Hat
  26. 2026-11-06 Affected versions changed · Red Hat
  27. 2026-11-06 Fix available: RHSA-2026:95591 · Red Hat
  28. 2026-11-06 Affected versions changed · Red Hat

References

Advisory 1

Other 7

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-25614 gRPC-Go has an authorization bypass via missing leading slash in :path CVSS 3.1CRITICAL 9.1
  • TI-2020-06285 Prototype pollution in grpc CVSS 3.1CRITICAL 9.8
  • TI-2017-05916 Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based… CVSS 3.0CRITICAL 9.8
  • TI-2017-05476 Google gRPC before 2017-02-22 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
  • TI-2017-06843 Google gRPC before 2017-04-05 has an out-of-bounds write caused by a heap-based buffer… CVSS 3.0CRITICAL 9.8
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences