p PatchFirst

CVE-2026-84304

CVE-2026-84304 · gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.

CVSS 8.7 · High · EPSS 0.6%

Published
Updated

Stack: system

Affected products and versions

  • grpc-go

    Versions
    • < 1.83.1: Affected

    No fix published

  • golang-google-grpc Debian:12

    Versions
    • 1.33.3-2
    • 1.38.0+really1.33.3-1
    • 1.38.0-1
    • 1.38.0-2
    • 1.38.0-3
    • 1.38.0-4
    • 1.38.0-5
    • 1.38.1-1
    • 1.59.0-1
    • 1.60.1-1
    • 1.60.1-2
    • 1.64.0-1
    • 1.64.0-2
    • 1.64.0-3
    • 1.64.0-4
    • 1.64.0-5
    • 1.64.0-6
    • 1.64.0-7
    • 1.66.3-1
    • 1.66.3-2
    • 1.75.1-1
    • 1.79.3-1
    • 1.79.3-1~bpo13+1
    • 1.81.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Debian:13

    Versions
    • 1.64.0-7
    • 1.66.3-1
    • 1.66.3-2
    • 1.75.1-1
    • 1.79.3-1
    • 1.79.3-1~bpo13+1
    • 1.81.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Debian:14

    Versions
    • 1.64.0-7
    • 1.66.3-1
    • 1.66.3-2
    • 1.75.1-1
    • 1.79.3-1
    • 1.79.3-1~bpo13+1
    • 1.81.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:16.04:LTS

    Versions
    • 0.0~git20150514.0.f5ebd86-1
    • 0.0~git20150514.0.f5ebd86-2
    • 0.0~git20151002.0.3e7b7e5-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:16.04:LTS

    Versions
    • 20201217.02-0ubuntu1~16.04.0
    • 20230426.00-0ubuntu2~16.04.3
    • 20231004.02-0ubuntu1~16.04.1
    • 20231004.02-0ubuntu1~16.04.2
    • 20240716.00-0ubuntu1~16.04.0
    • 20240716.00-0ubuntu1~16.04.0+esm1
    • 20240716.00-0ubuntu1~16.04.0+esm2
    • 20240716.00-0ubuntu1~16.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:16.04:LTS

    Versions
    • 0.10.2-1
    • 0.11.1-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:18.04:LTS

    Versions
    • 1.0.4-1
    • 1.6.0-2
    • 1.6.0-3
    • 1.6.0-3ubuntu0.18.04.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:18.04:LTS

    Versions
    • 20201217.02-0ubuntu1~18.04.0
    • 20210414.00-0ubuntu1~18.04.0
    • 20210629.00-0ubuntu1~18.04.1
    • 20220622.00-0ubuntu2~18.04.0
    • 20220622.00-0ubuntu2~18.04.1
    • 20230426.00-0ubuntu2~18.04.0
    • 20231004.02-0ubuntu1~18.04.2
    • 20231004.02-0ubuntu1~18.04.3
    • 20240716.00-0ubuntu1~18.04.0
    • 20241011.01-0ubuntu1~18.04.0
    • 20241011.01-0ubuntu1~18.04.0+esm1
    • 20241011.01-0ubuntu1~18.04.0+esm2
    • 20241011.01-0ubuntu1~18.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:18.04:LTS

    Versions
    • 1.3.2-1
    • 1.3.2-1ubuntu1
    • 1.3.2-1.1~build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:Pro:20.04:LTS

    Versions
    • 20201217.02-0ubuntu1~20.04.0
    • 20210414.00-0ubuntu1~20.04.0
    • 20210629.00-0ubuntu1~20.04.0
    • 20220622.00-0ubuntu2~20.04.0
    • 20220622.00-0ubuntu2~20.04.2
    • 20230426.00-0ubuntu2~20.04.0
    • 20231004.02-0ubuntu1~20.04.1
    • 20231004.02-0ubuntu1~20.04.2
    • 20231004.02-0ubuntu1~20.04.3
    • 20231004.02-0ubuntu1~20.04.4
    • 20240716.00-0ubuntu1~20.04.0
    • 20241011.01-0ubuntu1~20.04.1
    • 20250116.00-0ubuntu1~20.04.0
    • 20250116.00-0ubuntu1~20.04.0+esm1
    • 20250116.00-0ubuntu1~20.04.0+esm2
    • 20250116.00-0ubuntu1~20.04.0+esm3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:20.04:LTS

    Versions
    • 1.22.1-1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:20.04:LTS

    Versions
    • 1.16.1-1
    • 1.16.1-1ubuntu1
    • 1.16.1-1ubuntu3
    • 1.16.1-1ubuntu4
    • 1.16.1-1ubuntu5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:22.04:LTS

    Versions
    • 1.29.1-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:22.04:LTS

    Versions
    • 20210629.00-0ubuntu1
    • 20210629.00-0ubuntu2
    • 20220104.00-0ubuntu1
    • 20220104.00-0ubuntu2
    • 20220622.00-0ubuntu2~22.04.0
    • 20220622.00-0ubuntu2~22.04.1
    • 20230426.00-0ubuntu2~22.04.0
    • 20231004.02-0ubuntu1~22.04.1
    • 20231004.02-0ubuntu1~22.04.2
    • 20231004.02-0ubuntu1~22.04.3
    • 20231004.02-0ubuntu1~22.04.4
    • 20231004.02-0ubuntu1~22.04.5
    • 20240716.00-0ubuntu1~22.04.0
    • 20241011.01-0ubuntu1~22.04.0
    • 20250116.00-0ubuntu1~22.04.0
    • 20250116.00-0ubuntu1~22.04.1
    • 20250116.00-0ubuntu1~22.04.2
    • 20250116.00-0ubuntu1~22.04.3
    • 20250116.00-0ubuntu1~22.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:22.04:LTS

    Versions
    • 1.30.2-3
    • 1.30.2-3build1
    • 1.30.2-3build3
    • 1.30.2-3build5
    • 1.30.2-3build6
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:24.04:LTS

    Versions
    • 20230426.00-0ubuntu3
    • 20231004.02-0ubuntu1
    • 20231004.02-0ubuntu3
    • 20240213.00-0ubuntu1
    • 20240213.00-0ubuntu2
    • 20240213.00-0ubuntu3
    • 20240213.00-0ubuntu3.1
    • 20240213.00-0ubuntu3.2
    • 20240716.00-0ubuntu1~24.04.0
    • 20240716.00-0ubuntu1~24.04.1
    • 20241011.01-0ubuntu1~24.04.0
    • 20250116.00-0ubuntu1~24.04.0
    • 20250116.00-0ubuntu1~24.04.1
    • 20250116.00-0ubuntu1~24.04.2
    • 20250116.00-0ubuntu1~24.04.3
    • 20250116.00-0ubuntu1~24.04.4
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:24.04:LTS

    Versions
    • 1.51.1-3build3
    • 1.51.1-3build4
    • 1.51.1-4
    • 1.51.1-4build1
    • 1.51.1-4build2
    • 1.51.1-4.1build3
    • 1.51.1-4.1build4
    • 1.51.1-4.1build5
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:Pro:24.04:LTS

    Versions
    • 1.38.0+really1.33.3-1build1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.2
    • 1.38.0+really1.33.3-1ubuntu0.24.04.2+esm1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3+esm1
    • 1.38.0+really1.33.3-1ubuntu0.24.04.3+esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:26.10

    Versions
    • 1.66.3-2
    • 1.81.1-1build1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:26.10

    Versions
    • 20250506.01-0ubuntu2
    • 20250506.01-0ubuntu3
    • 20260819.00+~20260819.00-0ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • grpc Ubuntu:26.10

    Versions
    • 1.51.1-8ubuntu1
    • 1.51.1-9
    • 1.51.1-9ubuntu3
    • 1.51.1-10ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • golang-google-grpc Ubuntu:26.04:LTS

    Versions
    • 1.64.0-7
    • 1.66.3-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • google-guest-agent Ubuntu:26.04:LTS

    Versions
    • 20250506.01-0ubuntu1
    • 20250506.01-0ubuntu2
    • 20250506.01-0ubuntu2.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →