CVE-2026-84304

Name of the Vulnerable Software and Affected Versions gRPC-Go versions prior to 1.83.1

Description An unauthenticated remote attacker can cause a remote Denial of Service (DoS) by initiating a gRPC stream and fragmenting the payload into millions of small HTTP/2 DATA frames. In the internal/transport/transport.go file, each fragmented frame is stored as a separate recvMsg in the recvBuffer. This causes disproportionate heap memory consumption due to internal tracking structures and queue allocation, even if the total payload remains within flow-control windows. By multiplexing multiple concurrent streams, an attacker can exhaust process memory, leading to a runtime panic or out-of-memory termination.

Recommendations Update to version 1.83.1. Ensure the receive buffer compaction feature is enabled by not setting the GRPC GO EXPERIMENTAL ENABLE RECEIVE BUFFER COMPACTION environment variable to false.