Is CVE-2026-84304 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-84304 being exploited in the wild.

How severe is CVE-2026-84304?

High severity, with a CVSS score of 4, published 1 September 2026.

Which products and versions are affected?

google.golang.org/grpc (Go) <= 1.83.0, SEMVER:introduced=0,fixed=1.83.1.

Is there a fix for CVE-2026-84304?

Yes. google.golang.org/grpc (Go): upgrade to 1.83.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-84304 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-84304?

Check whether you run google.golang.org/grpc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84304: gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation

Q: Is there a fix for CVE-2026-84304?

Yes. google.golang.org/grpc (Go): upgrade to 1.83.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-84304 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-84304?

Check whether you run google.golang.org/grpc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-84304 · Severity: high · CVSS 4 · Published 2026-09-01

gRPC-Go is a widely-used remote procedure call framework for Go applications. An attacker can remotely crash any gRPC-Go service by sending specially crafted network packets that fragment data into millions of tiny pieces, exhausting the server's memory and forcing it offline. No authentication or special privileges are required to launch this attack, making it a critical availability threat for any service exposed to untrusted networks.

Technologies: google.golang.org/grpc (Go). Vendors: Go.

Quick answers

Is CVE-2026-84304 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-84304 being exploited in the wild.
How severe is CVE-2026-84304?: High severity, with a CVSS score of 4, published 1 September 2026.
Which products and versions are affected?: google.golang.org/grpc (Go) <= 1.83.0, SEMVER:introduced=0,fixed=1.83.1.
Is there a fix for CVE-2026-84304?: Yes. google.golang.org/grpc (Go): upgrade to 1.83.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-84304 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-84304?: Check whether you run google.golang.org/grpc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

google.golang.org/grpc (Go): upgrade to 1.83.1 or later
```
go get google.golang.org/grpc@v1.83.1
```

Technical details

This vulnerability is a heap memory exhaustion (denial-of-service) issue caused by insufficient controls on per-frame memory overhead in the HTTP/2 transport layer. An unauthenticated attacker can initiate a gRPC stream and deliberately fragment a payload into millions of tiny (1-byte or similar) HTTP/2 DATA frames. Although the total payload volume remains within configured flow-control windows, each independent frame incurs memory overhead from internal tracking structures and queue allocation. By multiplexing multiple concurrent streams, an attacker can rapidly exhaust the runtime's heap memory, triggering a panic or out-of-memory kill. The root cause is the lack of buffer coalescing to merge small consecutive data buffers into larger allocations. A patch released in version 1.83.1 implements automatic receive buffer compaction—enabled by default—which coalesces small buffers into larger allocations from a shared pool, drastically reducing per-frame overhead. A temporary environment variable escape hatch (GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false) is provided for emergencies but will be removed in a future release.

Affected products

Google gRPC-Go <= 1.83.0

Identifiers

CVE-2026-84304
GHSA-vp52-pcj8-j9qc
GO-2026-6348

Timeline

2026-08-19: disclosed
2026-08-19: patched: Patch merged to master branch; version 1.83.1 released
2026-09-01: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.