Junglewise Threat Intelligence

CVE-2026-84304: gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation

CVE-2026-84304 · Severity: high · CVSS 8.7 · Published 2026-09-01

Executive brief

gRPC-Go is a widely-used remote procedure call framework for Go applications. An attacker can remotely crash any gRPC-Go service by sending specially crafted network packets that fragment data into millions of tiny pieces, exhausting the server's memory and forcing it offline. No authentication or special privileges are required to launch this attack, making it a critical availability threat for any service exposed to untrusted networks.

Technical details

This vulnerability is a heap memory exhaustion (denial-of-service) issue caused by insufficient controls on per-frame memory overhead in the HTTP/2 transport layer. An unauthenticated attacker can initiate a gRPC stream and deliberately fragment a payload into millions of tiny (1-byte or similar) HTTP/2 DATA frames. Although the total payload volume remains within configured flow-control windows, each independent frame incurs memory overhead from internal tracking structures and queue allocation. By multiplexing multiple concurrent streams, an attacker can rapidly exhaust the runtime's heap memory, triggering a panic or out-of-memory kill. The root cause is the lack of buffer coalescing to merge small consecutive data buffers into larger allocations. A patch released in version 1.83.1 implements automatic receive buffer compaction—enabled by default—which coalesces small buffers into larger allocations from a shared pool, drastically reducing per-frame overhead. A temporary environment variable escape hatch (GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false) is provided for emergencies but will be removed in a future release.

Affected products

  • Google gRPC-Go <= 1.83.0

Timeline

  • 2026-08-19: disclosed
  • 2026-08-19: patched: Patch merged to master branch; version 1.83.1 released
  • 2026-09-01: advisory: GitHub Advisory published

References

Related threats