# CVE-2026-84304: gRPC-Go heap memory exhaustion via HTTP/2 DATA frame fragmentation

Source: https://junglewise.ai/threats/cve-2026-84304-grpc-go-heap-memory-exhaustion-via-http-2-data-frame  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-01. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2026-84304 · Severity: high · CVSS 4 · Published 2026-09-01

gRPC-Go is a widely-used remote procedure call framework for Go applications. An attacker can remotely crash any gRPC-Go service by sending specially crafted network packets that fragment data into millions of tiny pieces, exhausting the server's memory and forcing it offline. No authentication or special privileges are required to launch this attack, making it a critical availability threat for any service exposed to untrusted networks.

Technologies: [google.golang.org/grpc (Go)](https://junglewise.ai/threats/technologies/google-golang-org-grpc). Vendors: [Go](https://junglewise.ai/threats/vendors/go).

## Quick answers

**Is CVE-2026-84304 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-84304 being exploited in the wild.

**How severe is CVE-2026-84304?** High severity, with a CVSS score of 4, published 1 September 2026.

**Which products and versions are affected?** google.golang.org/grpc (Go) <= 1.83.0, SEMVER:introduced=0,fixed=1.83.1.

**Is there a fix for CVE-2026-84304?** Yes. google.golang.org/grpc (Go): upgrade to 1.83.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-84304 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-84304?** Check whether you run google.golang.org/grpc (Go) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- google.golang.org/grpc (Go): upgrade to 1.83.1 or later

  ```sh
  go get google.golang.org/grpc@v1.83.1
  ```


## Technical details

This vulnerability is a heap memory exhaustion (denial-of-service) issue caused by insufficient controls on per-frame memory overhead in the HTTP/2 transport layer. An unauthenticated attacker can initiate a gRPC stream and deliberately fragment a payload into millions of tiny (1-byte or similar) HTTP/2 DATA frames. Although the total payload volume remains within configured flow-control windows, each independent frame incurs memory overhead from internal tracking structures and queue allocation. By multiplexing multiple concurrent streams, an attacker can rapidly exhaust the runtime's heap memory, triggering a panic or out-of-memory kill. The root cause is the lack of buffer coalescing to merge small consecutive data buffers into larger allocations. A patch released in version 1.83.1 implements automatic receive buffer compaction—enabled by default—which coalesces small buffers into larger allocations from a shared pool, drastically reducing per-frame overhead. A temporary environment variable escape hatch (GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false) is provided for emergencies but will be removed in a future release.

## Affected products

- Google gRPC-Go <= 1.83.0

## Identifiers

- CVE-2026-84304
- GHSA-vp52-pcj8-j9qc
- GO-2026-6348

## Timeline

- 2026-08-19: disclosed
- 2026-08-19: patched: Patch merged to master branch; version 1.83.1 released
- 2026-09-01: advisory: GitHub Advisory published

## References

- [https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc)
- [https://github.com/grpc/grpc-go/pull/9331](https://github.com/grpc/grpc-go/pull/9331)
- [https://github.com/grpc/grpc-go/pull/9333](https://github.com/grpc/grpc-go/pull/9333)
- [https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176](https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176)
- [https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77](https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77)

## Related threats

- [gRPC-Go xDS server denial of service via missing headers](https://junglewise.ai/threats/cve-2026-84445-grpc-go-xds-server-denial-of-service-via-missing-headers)
- [gRPC-Go xDS RBAC HTTP filter bypass via case-sensitive header matching](https://junglewise.ai/threats/cve-2026-84303-grpc-go-xds-rbac-http-filter-bypass-via-case-sensitive-header)
- [GO-2026-6061 - Vulnerabilities in the xDS RBAC authorization engine and the HTTP/2 transport server implementation in…](https://junglewise.ai/threats/go-2026-6061-vulnerabilities-in-the-xds-rbac-authorization-engine-and-2c07d92a)
- [gRPC-Go auth bypass and DoS in xDS RBAC and HTTP/2 transport](https://junglewise.ai/threats/grpc-go-auth-bypass-and-dos-in-xds-rbac-and-http-2-transport-878951d5)
- [gRPC gRPC-Go authorization bypass in HTTP/2 path validation](https://junglewise.ai/threats/cve-2026-33186-grpc-grpc-go-authorization-bypass-in-http-2-path-validation)