CVE-2026-84304 - High Severity Vulnerability
Vulnerable Library - google.golang.org/grpc-v1.80.0
Sample Path to Dependency File: /manageiq-operator/go.mod
Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/google.golang.org/grpc/@v/v1.80.0.mod
Dependency Hierarchy:
- sigs.k8s.io/controller-runtime-v0.24.0 (Root Library)
- k8s.io/apiserver-v0.36.0
- ❌ google.golang.org/grpc-v1.80.0 (Vulnerable Library)
Found in base branch: master
Vulnerability Details
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Publish Date: 2026-09-01
URL: CVE-2026-84304
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Release Date: 2026-09-01
Fix Resolution: https://github.com/grpc/grpc-go.git - v1.83.1
Step up your Open Source Security Game with Mend here
CVE-2026-84304 - High Severity Vulnerability
Sample Path to Dependency File: /manageiq-operator/go.mod
Path to vulnerable library: /home/wss-scanner/go/pkg/mod/cache/download/google.golang.org/grpc/@v/v1.80.0.mod
Dependency Hierarchy:
Found in base branch: master
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Publish Date: 2026-09-01
URL: CVE-2026-84304
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Release Date: 2026-09-01
Fix Resolution: https://github.com/grpc/grpc-go.git - v1.83.1
Step up your Open Source Security Game with Mend here