CVE-2026-84304: gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPCGOEXPERIMENTALENABLERECEIVEBUFFERCOMPACTION. This issue is fixed in version 1.83.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
gRPC-Goto a version that resolves this vulnerability.Fixed in 1.83.1 - Configuration
If you must mitigate before upgrading to v1.83.1, control receive-buffer compaction temporarily using the GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION environment variable (receive-buffer compaction is enabled by default).
gRPC-Go (transport receive buffer) GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION = enabled (default) / control temporarily as needed
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using gRPC-Go versions before 1.83.1 are affected. An unauthenticated remote attacker can target a reachable gRPC-Go endpoint using HTTP/2 DATA frames.
What does an attacker need to do to trigger the memory exhaustion?
The attacker sends millions of fragmented, potentially one-byte, HTTP/2 DATA frames and can use concurrent multiplexed streams. The payload can remain within connection and stream flow-control windows while per-frame buffering consumes disproportionate heap memory.
Are default settings affected, and what can be done before upgrading?
Receive-buffer compaction is enabled by default. As a temporary control, its behavior can be controlled with the GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION environment variable; upgrade to 1.83.1 for the fix.