Memory Management Vulnerability in gRPC-Go by Google

CVE-2026-84304

What is CVE-2026-84304?

In gRPC-Go, prior to version 1.83.1, a vulnerability exists where the handling of fragmented HTTP/2 DATA frames can lead to excessive memory consumption. By leveraging concurrent multiplexed streams, an unauthenticated remote attacker can exploit this weakness, causing a process to exhaust memory resources, potentially resulting in a runtime panic or an out-of-memory condition. Users are advised to upgrade to version 1.83.1 to mitigate this issue. This vulnerability highlights the importance of efficient resource management in high-performance applications.

References