CVE-2026-84304: gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Published Sep 1, 2026
·
Updated

Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.

Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).

Patches The change to fix this issue is merged in master and a patch release, 1.83.1, has been published that contains this fix.

Workarounds This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.

This behavior is enabled by default. A temporary escape hatch is provided via the environment variable GRPCGOEXPERIMENTALENABLERECEIVEBUFFERCOMPACTION=false to disable the feature if unforeseen issues arise, but it will be removed in a future release.

Other sources

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPCGOEXPERIMENTALENABLERECEIVEBUFFERCOMPACTION. This issue is fixed in version 1.83.1.

— NVD

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

— Microsoft

Affected Software

51 affected componentsFixes available
gRPC-Go gRPC-Go<1.83.1
go/google.golang.org/grpc<=1.83.0
1.83.1
IBM Concert Software<=1.0-3.0.0
All of the following
azurelinux/moby-containerd-cc<1.7.7-18
1.7.7-18
Microsoft Azure Linux=3.0
All of the following
azurelinux/packer<1.9.5-22
1.9.5-22
Microsoft Azure Linux=3.0
All of the following
azurelinux/kubevirt<1.8.4-3
1.8.4-3
Microsoft Azure Linux=3.0
All of the following
azurelinux/docker-buildx<0.14.0-18
0.14.0-18
Microsoft Azure Linux=3.0
All of the following
azurelinux/moby-engine<25.0.3-21
25.0.3-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/docker-compose<2.27.0-15
2.27.0-15
Microsoft Azure Linux=3.0
All of the following
azurelinux/flannel<0.24.2-33
0.24.2-33
Microsoft Azure Linux=3.0
All of the following
azurelinux/keda<2.14.1-21
2.14.1-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/kubernetes<1.30.10-31
1.30.10-31
Microsoft Azure Linux=3.0
All of the following
azurelinux/etcd<3.5.34-1
3.5.34-1
Microsoft Azure Linux=3.0
All of the following
azurelinux/kata-containers<3.32.0.kata0-6
3.32.0.kata0-6
Microsoft Azure Linux=3.0
All of the following
azurelinux/sriov-network-device-plugin<3.7.0-8
3.7.0-8
Microsoft Azure Linux=3.0
All of the following
azurelinux/cri-tools<1.32.0-9
1.32.0-9
Microsoft Azure Linux=3.0
All of the following
azurelinux/kata-containers-cc<3.15.0.aks0-21
3.15.0.aks0-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/azcopy<10.25.1-9
10.25.1-9
Microsoft Azure Linux=3.0
All of the following
azurelinux/coredns<1.11.4-21
1.11.4-21
Microsoft Azure Linux=3.0
All of the following
azurelinux/skopeo<1.14.4-13
1.14.4-13
Microsoft Azure Linux=3.0
All of the following
azurelinux/containerized-data-importer<1.62.0-8
1.62.0-8
Microsoft Azure Linux=3.0
All of the following
azurelinux/azurelinux-image-tools<1.6.0-3
1.6.0-3
Microsoft Azure Linux=3.0
All of the following
azurelinux/vitess<19.0.4-14
19.0.4-14
Microsoft Azure Linux=3.0
All of the following
azurelinux/multus<4.0.2-11
4.0.2-11
Microsoft Azure Linux=3.0
All of the following
azurelinux/gh<2.101.0-1
2.101.0-1
Microsoft Azure Linux=3.0
All of the following
azurelinux/telegraf<1.31.0-33
1.31.0-33
Microsoft Azure Linux=3.0
All of the following
azurelinux/containerd2<2.3.7-1
2.3.7-1
Microsoft Azure Linux=3.0

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade go/google.golang.org/grpc to a version that resolves this vulnerability.

    Fixed in 1.83.1
  2. Upgrade

    Upgrade azurelinux/moby-containerd-cc to a version that resolves this vulnerability.

    Fixed in 1.7.7-18
  3. Upgrade

    Upgrade azurelinux/packer to a version that resolves this vulnerability.

    Fixed in 1.9.5-22
  4. Upgrade

    Upgrade azurelinux/kubevirt to a version that resolves this vulnerability.

    Fixed in 1.8.4-3
  5. Upgrade

    Upgrade azurelinux/docker-buildx to a version that resolves this vulnerability.

    Fixed in 0.14.0-18
  6. Upgrade

    Upgrade azurelinux/moby-engine to a version that resolves this vulnerability.

    Fixed in 25.0.3-21
  7. Upgrade

    Upgrade azurelinux/docker-compose to a version that resolves this vulnerability.

    Fixed in 2.27.0-15
  8. Upgrade

    Upgrade azurelinux/flannel to a version that resolves this vulnerability.

    Fixed in 0.24.2-33
  9. Upgrade

    Upgrade azurelinux/keda to a version that resolves this vulnerability.

    Fixed in 2.14.1-21
  10. Upgrade

    Upgrade azurelinux/kubernetes to a version that resolves this vulnerability.

    Fixed in 1.30.10-31
  11. Upgrade

    Upgrade azurelinux/etcd to a version that resolves this vulnerability.

    Fixed in 3.5.34-1
  12. Upgrade

    Upgrade azurelinux/kata-containers to a version that resolves this vulnerability.

    Fixed in 3.32.0.kata0-6
  13. Upgrade

    Upgrade azurelinux/sriov-network-device-plugin to a version that resolves this vulnerability.

    Fixed in 3.7.0-8
  14. Upgrade

    Upgrade azurelinux/cri-tools to a version that resolves this vulnerability.

    Fixed in 1.32.0-9
  15. Upgrade

    Upgrade azurelinux/kata-containers-cc to a version that resolves this vulnerability.

    Fixed in 3.15.0.aks0-21
  16. Upgrade

    Upgrade azurelinux/azcopy to a version that resolves this vulnerability.

    Fixed in 10.25.1-9
  17. Upgrade

    Upgrade azurelinux/coredns to a version that resolves this vulnerability.

    Fixed in 1.11.4-21
  18. Upgrade

    Upgrade azurelinux/skopeo to a version that resolves this vulnerability.

    Fixed in 1.14.4-13
  19. Upgrade

    Upgrade azurelinux/containerized-data-importer to a version that resolves this vulnerability.

    Fixed in 1.62.0-8
  20. Upgrade

    Upgrade azurelinux/azurelinux-image-tools to a version that resolves this vulnerability.

    Fixed in 1.6.0-3
  21. Upgrade

    Upgrade azurelinux/vitess to a version that resolves this vulnerability.

    Fixed in 19.0.4-14
  22. Upgrade

    Upgrade azurelinux/multus to a version that resolves this vulnerability.

    Fixed in 4.0.2-11
  23. Upgrade

    Upgrade azurelinux/gh to a version that resolves this vulnerability.

    Fixed in 2.101.0-1
  24. Upgrade

    Upgrade azurelinux/telegraf to a version that resolves this vulnerability.

    Fixed in 1.31.0-33
  25. Upgrade

    Upgrade azurelinux/containerd2 to a version that resolves this vulnerability.

    Fixed in 2.3.7-1
  26. Upgrade

    Upgrade gRPC-Go to a version that resolves this vulnerability.

    Fixed in 1.83.1
  27. Configuration

    Temporarily disable receive-buffer compaction by setting environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false (escape hatch); note it will be removed in a future release.

    gRPC-Go GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION = false

Event History

Sep 1, 2026
CVE Published
via MITRE·06:19 PM
Data Sourced
via MITRE·06:19 PM
DescriptionWeakness
Data Sourced
via OSV·06:19 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·07:17 PM
DescriptionSeverityWeakness
Advisory Published
via GitHub·09:32 PM
Data Sourced
via GitHub·09:32 PM
DescriptionWeaknessAffected Software
Sep 5, 2026
Data Sourced
via Microsoft·08:37 AM
DescriptionSeverityWeaknessAffected Software
Oct 14, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Frequently Asked Questions

1

Which deployments are exposed to this denial-of-service issue?

Deployments using gRPC-Go versions before 1.83.1 are affected. An unauthenticated remote attacker can target a reachable gRPC-Go endpoint using HTTP/2 DATA frames.

2

What does an attacker need to do to trigger the memory exhaustion?

The attacker sends millions of fragmented, potentially one-byte, HTTP/2 DATA frames and can use concurrent multiplexed streams. The payload can remain within connection and stream flow-control windows while per-frame buffering consumes disproportionate heap memory.

3

Are default settings affected, and what can be done before upgrading?

Receive-buffer compaction is enabled by default. As a temporary control, its behavior can be controlled with the GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION environment variable; upgrade to 1.83.1 for the fix.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203