CVE-2026-84304

gRPC-Go before 1.83.1 stores every fragmented HTTP/2 DATA frame as a separate recvMsg in its receive buffer, so millions of tiny (e.g., one-byte) frames can inflate the process heap far beyond the actual payload size even while staying within connection and stream flow-control windows. An unauthenticated remote attacker triggers this by opening concurrent multiplexed streams and sending such fragmented DATA frames to any gRPC service built with an affected version. The outcome is uncontrolled resource consumption (CWE-400) culminating in a Go runtime panic or out-of-memory process termination, i.e., a denial of service with no confidentiality or integrity impact per the CVSS 4.0 score of 8.7. Anyone running a gRPC server implemented with gRPC-Go, including as a transitive dependency of Go services, that accepts traffic from untrusted network clients is affected. Exploitation has not been observed: there is no public proof-of-concept, the issue is not in CISA KEV, and EPSS estimates only a 0.4% probability of exploitation within 30 days.

What to do: Upgrade gRPC-Go to 1.83.1 or later and rebuild and redeploy affected Go services. If upgrading is delayed, verify receive-buffer compaction has not been disabled (it is enabled by default and toggled via GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION where available), and restrict or rate-limit unauthenticated network access to gRPC endpoints. Audit go.mod and dependency trees for gRPC-Go versions below 1.83.1, since the library is frequently pulled in transitively.