CVE-2026-84304: CWE-400: Uncontrolled Resource Consumption in grpc grpc-go
Description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
CVSS v4.0
Score 8.7high
Affected software
grpc
grpc-go
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability CVE-2026-84304 affects grpc-go versions prior to 1.83.1. It arises from uncontrolled resource consumption due to fragmented HTTP/2 DATA frames being stored separately in memory. An unauthenticated remote attacker can exploit this flaw to exhaust the process memory, potentially causing runtime panics or out-of-memory termination. This vulnerability is classified under CWE-400 (Uncontrolled Resource Consumption). The fix for this issue was released in grpc-go version 1.83.1.
Potential Impact
An unauthenticated remote attacker can exploit this vulnerability to exhaust the memory of the affected grpc-go process. This can result in runtime panics or the process being terminated due to out-of-memory conditions, potentially causing denial of service.
Mitigation Recommendations
A fix is available in grpc-go version 1.83.1. Users should upgrade to version 1.83.1 or later to remediate this vulnerability.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-09-01T16:17:43.078Z
- Cvss Version
- 4.0
- State
- PUBLISHED
Threat ID: 6a971b7aacd9273b490f4b60
Added to database: 09/01/2026, 18:37:46 UTC
Last enriched: 10/10/2026, 21:44:02 UTC
Last updated: 10/16/2026, 06:48:19 UTC
Views: 136
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.