CVE-2026-84304: gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
Impact An unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.
Repeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).
Patches The change to fix this issue is merged in master and a patch release, 1.83.1, has been published that contains this fix.
Workarounds This vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.
This behavior is enabled by default. A temporary escape hatch is provided via the environment variable GRPCGOEXPERIMENTALENABLERECEIVEBUFFERCOMPACTION=false to disable the feature if unforeseen issues arise, but it will be removed in a future release.
Other sources
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPCGOEXPERIMENTALENABLERECEIVEBUFFERCOMPACTION. This issue is fixed in version 1.83.1.
— NVD
gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/google.golang.org/grpcto a version that resolves this vulnerability.Fixed in 1.83.1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.31.0-33 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.11.4-21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 19.0.4-14 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.15.0.aks0-21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.32.0.kata0-6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.6.0-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.7.0-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 10.25.1-9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.14.4-13 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 4.0.2-11 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.62.0-8 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.101.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 3.5.34-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.7.7-18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.4.0-1 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.8.4-3 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.14.0-18 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 25.0.3-21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.27.0-15 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.30.10-31 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 2.14.1-21 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.9.5-22 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 1.32.0-9 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 0.24.2-33 - Upgrade
Upgrade
gRPC-Goto a version that resolves this vulnerability.Fixed in 1.83.1 - Configuration
Temporarily disable receive-buffer compaction by setting environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false (escape hatch); note it will be removed in a future release.
gRPC-Go GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION = false
Event History
Frequently Asked Questions
Which deployments are exposed to this denial-of-service issue?
Deployments using gRPC-Go versions before 1.83.1 are affected. An unauthenticated remote attacker can target a reachable gRPC-Go endpoint using HTTP/2 DATA frames.
What does an attacker need to do to trigger the memory exhaustion?
The attacker sends millions of fragmented, potentially one-byte, HTTP/2 DATA frames and can use concurrent multiplexed streams. The payload can remain within connection and stream flow-control windows while per-frame buffering consumes disproportionate heap memory.
Are default settings affected, and what can be done before upgrading?
Receive-buffer compaction is enabled by default. As a temporary control, its behavior can be controlled with the GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION environment variable; upgrade to 1.83.1 for the fix.