{"id":"GHSA-vp52-pcj8-j9qc","revision":null,"records":[{"revision":"de7d430601774b6db1730a38e8b7b8a3","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-84304","aliases":[],"title":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.","state":0,"publishedAt":"2026-09-01T18:19:10.1+00:00","modifiedAt":"2026-09-01T19:24:36.867+00:00","affected":[{"ecosystem":"Vendor product","name":"grpc-go","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"grpc\",\n                    \"product\": \"grpc-go\",\n                    \"versions\": [\n                        {\n                            \"version\": \"< 1.83.1\",\n                            \"status\": \"affected\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":"HIGH"}],"references":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-84304","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-84304","identifiers":["CVE-2026-84304"]},"retained":false,"historicalAffected":[]},{"revision":"e6ea85c538a24564852ec510b1a27681","observedAt":"2026-11-11T17:00:52.431+00:00","statement":{"source":"euvd","id":"EUVD-2026-69420","aliases":["CVE-2026-84304","GHSA-vp52-pcj8-j9qc"],"title":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate he…","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.","state":0,"publishedAt":null,"modifiedAt":null,"affected":[],"metrics":[{"system":"EUVD CVSS 4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":8.7,"severity":null}],"references":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"sourceUrl":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-69420","license":"ENISA EUVD · source terms and attribution apply","enrichment":{"sourceStatus":null,"weaknesses":[],"productCriteria":[],"sourceDates":{"datePublished":"Sep 1, 2026, 6:19:10 PM","dateUpdated":"Sep 1, 2026, 7:24:36 PM"},"relatedAdvisories":[{"id":"SUSE-SU-2026:23729-1","title":"Security update for google-cloud-sap-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:4292-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11830-1","title":"apptainer-1.5.3-4.1 on GA media","vulnerabilityIds":["CVE-2026-56854","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22026-1","title":"Security update for prometheus-blackbox_exporter","vulnerabilityIds":["CVE-2023-45288","CVE-2025-22870","CVE-2026-39821","CVE-2026-84304"]},{"id":"SUSE-SU-2026:23864-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-37236","CVE-2026-39827","CVE-2026-41178","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:92307","title":"Red Hat Security Advisory: Red Hat Advanced Cluster Management for Kubernetes v2.13.14 security update","vulnerabilityIds":["CVE-2026-14199","CVE-2026-15815","CVE-2026-33818","CVE-2026-37236","CVE-2026-39834","CVE-2026-56853","CVE-2026-56854","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-77354","CVE-2026-77405","CVE-2026-77411","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-88031","CVE-2026-93748","CVE-2026-106445","CVE-2026-106446"]},{"id":"SUSE-SU-2026:23736-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:82304","title":"Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2","vulnerabilityIds":["CVE-2024-34459","CVE-2025-5278","CVE-2025-6170","CVE-2025-13151","CVE-2025-14087","CVE-2025-14512","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-58190","CVE-2026-1965","CVE-2026-2100","CVE-2026-2673","CVE-2026-3783","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-4424","CVE-2026-4437","CVE-2026-4438","CVE-2026-4878","CVE-2026-5121","CVE-2026-5260","CVE-2026-5419","CVE-2026-5435","CVE-2026-5450","CVE-2026-5928","CVE-2026-6238","CVE-2026-6653","CVE-2026-7383","CVE-2026-8286","CVE-2026-9076","CVE-2026-9547","CVE-2026-11822","CVE-2026-11824","CVE-2026-11979","CVE-2026-13757","CVE-2026-14164","CVE-2026-15588","CVE-2026-16118","CVE-2026-25680","CVE-2026-25681","CVE-2026-27135","CVE-2026-27136","CVE-2026-28390","CVE-2026-29111","CVE-2026-31790","CVE-2026-33186","CVE-2026-33845","CVE-2026-33846","CVE-2026-34180","CVE-2026-34181","CVE-2026-34182","CVE-2026-34183","CVE-2026-34986","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-40355","CVE-2026-40356","CVE-2026-41989","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-42764","CVE-2026-42766","CVE-2026-42767","CVE-2026-42768","CVE-2026-42769","CVE-2026-42770","CVE-2026-45445","CVE-2026-45446","CVE-2026-45447","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-46600","CVE-2026-48864","CVE-2026-54369","CVE-2026-54370","CVE-2026-54371","CVE-2026-56854","CVE-2026-56855","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58016","CVE-2026-58055","CVE-2026-78662","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:12186-1","title":"rqlite-10.6.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-63209","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"]},{"id":"openSUSE-SU-2026:11695-1","title":"cadvisor-0.60.5-3.1 on GA media","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:82322","title":"Red Hat Security Advisory: cert-manager Operator for Red Hat OpenShift 1.17.2","vulnerabilityIds":["CVE-2024-34459","CVE-2025-5278","CVE-2025-6170","CVE-2025-13151","CVE-2025-14087","CVE-2025-14512","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58181","CVE-2025-58190","CVE-2026-1965","CVE-2026-2100","CVE-2026-2673","CVE-2026-3783","CVE-2026-3832","CVE-2026-3833","CVE-2026-4046","CVE-2026-4424","CVE-2026-4437","CVE-2026-4438","CVE-2026-4878","CVE-2026-5121","CVE-2026-5260","CVE-2026-5419","CVE-2026-5435","CVE-2026-5450","CVE-2026-5928","CVE-2026-6238","CVE-2026-6653","CVE-2026-7383","CVE-2026-8286","CVE-2026-9076","CVE-2026-9547","CVE-2026-11822","CVE-2026-11824","CVE-2026-11979","CVE-2026-13757","CVE-2026-14164","CVE-2026-15588","CVE-2026-16118","CVE-2026-25680","CVE-2026-25681","CVE-2026-27135","CVE-2026-27136","CVE-2026-28390","CVE-2026-29111","CVE-2026-29181","CVE-2026-31790","CVE-2026-33186","CVE-2026-33845","CVE-2026-33846","CVE-2026-34180","CVE-2026-34181","CVE-2026-34182","CVE-2026-34183","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-40355","CVE-2026-40356","CVE-2026-41989","CVE-2026-42009","CVE-2026-42010","CVE-2026-42011","CVE-2026-42012","CVE-2026-42013","CVE-2026-42014","CVE-2026-42015","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-42764","CVE-2026-42766","CVE-2026-42767","CVE-2026-42768","CVE-2026-42769","CVE-2026-42770","CVE-2026-45445","CVE-2026-45446","CVE-2026-45447","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-46600","CVE-2026-48864","CVE-2026-54369","CVE-2026-54370","CVE-2026-54371","CVE-2026-56854","CVE-2026-56855","CVE-2026-58010","CVE-2026-58011","CVE-2026-58012","CVE-2026-58013","CVE-2026-58014","CVE-2026-58015","CVE-2026-58016","CVE-2026-58055","CVE-2026-78662","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11828-1","title":"amazon-cloudwatch-agent-1.300072.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-37236","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:23831-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11911-1","title":"wait4x-3.7.2-1.1 on GA media","vulnerabilityIds":["CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11740-1","title":"azure-storage-azcopy-10.32.8-1.1 on GA media","vulnerabilityIds":["CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21996-1","title":"Security update for v2ray-core","vulnerabilityIds":["CVE-2026-39821","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11752-1","title":"kubevirt1.9-container-disk-1.9.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-13622","CVE-2026-56854","CVE-2026-56855","CVE-2026-84303","CVE-2026-84304"]},{"id":"SUSE-SU-2026:23548-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-39821","CVE-2026-56852","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11837-1","title":"mcphost-0.34.0-11.1 on GA media","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21882-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22035-1","title":"Security update for amazon-ecs-init","vulnerabilityIds":["CVE-2026-41178","CVE-2026-84303","CVE-2026-84304"]},{"id":"SUSE-SU-2026:23546-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11881-1","title":"kubectl-cnpg-1.30.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-84304"]},{"id":"openSUSE-SU-2026:11871-1","title":"cosign-3.1.3-1.1 on GA media","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56855","CVE-2026-56864","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:11731-1","title":"containerized-data-importer1.65-api-1.65.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-84303","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:12114-1","title":"alloy-1.20.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-14362","CVE-2026-63209","CVE-2026-81871","CVE-2026-81872","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:24213-1","title":"Security update for cosign","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-78662","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:21841-1","title":"Security update for hauler","vulnerabilityIds":["CVE-2026-41888","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11914-1","title":"amazon-ecs-init-1.107.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-41178","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:21801-1","title":"Security update for trivy","vulnerabilityIds":["CVE-2026-24122","CVE-2026-37236","CVE-2026-41178","CVE-2026-50163","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21898-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-37236","CVE-2026-39827","CVE-2026-41178","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21809-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-37236","CVE-2026-41178","CVE-2026-48978","CVE-2026-50151","CVE-2026-63308","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22224-1","title":"Security update for rqlite","vulnerabilityIds":["CVE-2026-39821","CVE-2026-63209","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445","CVE-2026-89090"]},{"id":"openSUSE-SU-2026:21834-1","title":"Security update for google-cloud-sap-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21927-1","title":"Security update for apptainer","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:89041","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39821","CVE-2026-40161","CVE-2026-40938","CVE-2026-46600","CVE-2026-56851","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-78667","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445","CVE-2026-97031","CVE-2026-111943"]},{"id":"openSUSE-SU-2026:22135-1","title":"Security update for coredns","vulnerabilityIds":["CVE-2026-84304"]},{"id":"RHSA-2026:89131","title":"Red Hat Security Advisory: Red Hat OpenShift Builds 1.9.2","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39821","CVE-2026-40161","CVE-2026-40938","CVE-2026-46600","CVE-2026-56851","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-78667","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445","CVE-2026-97031","CVE-2026-111943","CVE-2026-114406"]},{"id":"openSUSE-SU-2026:12163-1","title":"gh-2.102.0-1.1 on GA media","vulnerabilityIds":["CVE-2026-41178","CVE-2026-59831","CVE-2026-63209","CVE-2026-72924","CVE-2026-78669","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:79575","title":"Red Hat Security Advisory: RHACS 4.11.5 security and bug fix update","vulnerabilityIds":["CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:4178-1","title":"Security update for google-cloud-sap-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:92593","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.2","vulnerabilityIds":["CVE-2026-41178","CVE-2026-42499","CVE-2026-63209","CVE-2026-77619","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11742-1","title":"google-guest-agent-20260903.01-1.1 on GA media","vulnerabilityIds":["CVE-2026-84304"]},{"id":"SUSE-SU-2026:23852-1","title":"Security update for distribution","vulnerabilityIds":["CVE-2026-37236","CVE-2026-39827","CVE-2026-41178","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:95081","title":"Red Hat Security Advisory: Cluster Observability Operator - 1.5","vulnerabilityIds":["CVE-2026-19534","CVE-2026-27145","CVE-2026-33818","CVE-2026-39821","CVE-2026-39822","CVE-2026-39834","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77301","CVE-2026-82417","CVE-2026-84292","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-84961","CVE-2026-85152","CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-109383","CVE-2026-109829","CVE-2026-109855","CVE-2026-109869"]},{"id":"openSUSE-SU-2026:12241-1","title":"kubevirt1.8-container-disk-1.8.4-7.1 on GA media","vulnerabilityIds":["CVE-2026-56854","CVE-2026-78659","CVE-2026-78660","CVE-2026-78662","CVE-2026-78669","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:4272-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-33186","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:23688-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-37236","CVE-2026-41178","CVE-2026-48978","CVE-2026-50151","CVE-2026-63308","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:12149-1","title":"coredns-1.14.7-3.1 on GA media","vulnerabilityIds":["CVE-2026-84304"]},{"id":"openSUSE-SU-2026:11920-1","title":"grafana-12.4.11-1.1 on GA media","vulnerabilityIds":["CVE-2026-15815","CVE-2026-56855","CVE-2026-76154","CVE-2026-79656","CVE-2026-83530","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21824-1","title":"Security update for containerized-data-importer1.65","vulnerabilityIds":["CVE-2025-22869","CVE-2025-22870","CVE-2025-22872","CVE-2025-47911","CVE-2025-47913","CVE-2025-47914","CVE-2025-58058","CVE-2025-58181","CVE-2025-58190","CVE-2026-25680","CVE-2026-25681","CVE-2026-27136","CVE-2026-33186","CVE-2026-33814","CVE-2026-34986","CVE-2026-35469","CVE-2026-39821","CVE-2026-39827","CVE-2026-39828","CVE-2026-39829","CVE-2026-39830","CVE-2026-39831","CVE-2026-39832","CVE-2026-39833","CVE-2026-39834","CVE-2026-39835","CVE-2026-41178","CVE-2026-42502","CVE-2026-42506","CVE-2026-42508","CVE-2026-46595","CVE-2026-46597","CVE-2026-46598","CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:21843-1","title":"Security update for cadvisor","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:23730-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:23739-1","title":"Security update for google-osconfig-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11686-1","title":"helm3-3.21.3-8.1 on GA media","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11713-1","title":"trivy-0.74.0-4.1 on GA media","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:92515","title":"Red Hat Security Advisory: Logging for Red Hat OpenShift - 6.6.2","vulnerabilityIds":["CVE-2026-41178","CVE-2026-42499","CVE-2026-63209","CVE-2026-77619","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11700-1","title":"hauler-2.1.0-3.1 on GA media","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11718-1","title":"helm-4.2.4-3.1 on GA media","vulnerabilityIds":["CVE-2026-37236","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:4308-1","title":"Security update for apptainer","vulnerabilityIds":["CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"msrc_CVE-2026-84304","title":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation","vulnerabilityIds":["CVE-2026-84304"]},{"id":"openSUSE-SU-2026:21879-1","title":"Security update for google-guest-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-78662","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:22134-1","title":"Security update for gh","vulnerabilityIds":["CVE-2026-41178","CVE-2026-59831","CVE-2026-63209","CVE-2026-72924","CVE-2026-78669","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:95591","title":"Red Hat Security Advisory: Cluster Observability Operator - 1.5","vulnerabilityIds":["CVE-2026-19534","CVE-2026-27145","CVE-2026-33818","CVE-2026-39821","CVE-2026-39822","CVE-2026-39834","CVE-2026-42504","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-75838","CVE-2026-75899","CVE-2026-75931","CVE-2026-75975","CVE-2026-76172","CVE-2026-77301","CVE-2026-82417","CVE-2026-84292","CVE-2026-84304","CVE-2026-84375","CVE-2026-84445","CVE-2026-84961","CVE-2026-85152","CVE-2026-87018","CVE-2026-102276","CVE-2026-102278","CVE-2026-109383","CVE-2026-109829","CVE-2026-109855","CVE-2026-109869","CVE-2026-116591"]},{"id":"openSUSE-SU-2026:12253-1","title":"tekton-cli-0.46.2-1.1 on GA media","vulnerabilityIds":["CVE-2026-111943","CVE-2026-84304"]},{"id":"SUSE-SU-2026:23506-1","title":"Security update for helm","vulnerabilityIds":["CVE-2026-37236","CVE-2026-41178","CVE-2026-48978","CVE-2026-50151","CVE-2026-63308","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:11925-1","title":"prometheus-blackbox_exporter-0.26.0-9.1 on GA media","vulnerabilityIds":["CVE-2026-84304"]},{"id":"SUSE-SU-2026:23708-1","title":"Security update for google-cloud-sap-agent","vulnerabilityIds":["CVE-2026-56852","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"openSUSE-SU-2026:21886-1","title":"Security update for mcphost","vulnerabilityIds":["CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"RHSA-2026:92303","title":"Red Hat Security Advisory: multicluster engine for Kubernetes v2.8.12 security update","vulnerabilityIds":["CVE-2026-33818","CVE-2026-39822","CVE-2026-39834","CVE-2026-56853","CVE-2026-56858","CVE-2026-56859","CVE-2026-56860","CVE-2026-56862","CVE-2026-63209","CVE-2026-84304","CVE-2026-93748","CVE-2026-106445","CVE-2026-106446"]},{"id":"openSUSE-SU-2026:11732-1","title":"containerized-data-importer1.66-api-1.66.1-1.1 on GA media","vulnerabilityIds":["CVE-2026-41178","CVE-2026-56854","CVE-2026-56855","CVE-2026-84303","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:11697-1","title":"distribution-registry-3.1.1-6.1 on GA media","vulnerabilityIds":["CVE-2026-37236","CVE-2026-84303","CVE-2026-84304","CVE-2026-84445"]},{"id":"SUSE-SU-2026:24150-1","title":"Security update for amazon-ecs-init","vulnerabilityIds":["CVE-2026-41178","CVE-2026-84303","CVE-2026-84304"]},{"id":"openSUSE-SU-2026:22064-1","title":"Security update for cosign","vulnerabilityIds":["CVE-2026-56852","CVE-2026-56854","CVE-2026-56855","CVE-2026-56864","CVE-2026-78662","CVE-2026-84304"]}],"note":"EUVD source date text has no stated timezone and is retained without inventing a UTC instant. Related bulletin membership is not an alias, common cause or applicability claim. A missing vector with a zero score is treated as unrated. Complete vendor/product and underlying source evidence remains in the original JSON."},"key":"euvd:EUVD-2026-69420","identifiers":["EUVD-2026-69420","CVE-2026-84304","GHSA-vp52-pcj8-j9qc"]},"retained":false,"historicalAffected":[]},{"revision":"131ceb3d1ad74fe2b6351a5906a921c4","observedAt":"2026-10-25T16:19:16.24+00:00","statement":{"source":"nvd","id":"CVE-2026-84304","aliases":[],"title":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate he…","description":"gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.","state":0,"publishedAt":"2026-09-01T19:17:30.743+00:00","modifiedAt":"2026-09-09T21:09:13.08+00:00","affected":[],"metrics":[{"system":"CVSS 4.0 · security-advisories@github.com · Secondary","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","score":8.7,"severity":"HIGH"}],"references":["https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/releases/tag/v1.83.1","https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-84304","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Deferred","weaknesses":["CWE-400"],"productCriteria":[],"sourceDates":{"published":"2026-09-01T19:17:30.743","lastModified":"2026-09-09T21:09:13.080"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2026-84304","identifiers":["CVE-2026-84304"]},"retained":false,"historicalAffected":[]},{"revision":"64e900c0f9564ad7a21c75486f326f37","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-vp52-pcj8-j9qc","aliases":["CVE-2026-84304","GO-2026-6348"],"title":"gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation","description":"### Impact\nAn unauthenticated remote attacker can initiate a gRPC stream and purposefully fragment their payload into millions of tiny (e.g., 1-byte) HTTP/2 DATA frames. Even if the total payload volume falls within the configured connection and stream flow-control windows, each independent fragment incurs memory overhead due to internal tracking structures and queue allocation.\n\nRepeated fragmentation massively inflates the heap space consumed by the stream. An attacker multiplexing multiple concurrent streams can exhaust the memory bounds of the runtime, forcing a runtime panic or OutOfMemory condition and leading to a remote Denial of Service (DoS).\n\n### Patches\nThe change to fix this issue is merged in `master` and a patch release, 1.83.1, has been published that contains this fix.\n\n### Workarounds\nThis vulnerability is mitigated by implementing receive buffer compaction. Consecutive small data buffers are automatically coalesced into larger buffers from a shared pool once the overhead is perceived to be excessive relative to actual payload data, drastically minimizing per-frame memory overheads.\n\nThis behavior is enabled by default. A temporary escape hatch is provided via the environment variable `GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false` to disable the feature if unforeseen issues arise, but it will be removed in a future release.","state":0,"publishedAt":"2026-09-01T21:32:41+00:00","modifiedAt":"2026-09-15T19:10:44.5609753+00:00","affected":[{"ecosystem":"Go","name":"google.golang.org/grpc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.83.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"HIGH"}],"references":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://nvd.nist.gov/vuln/detail/CVE-2026-84304","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"sourceUrl":"https://github.com/advisories/GHSA-vp52-pcj8-j9qc","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-vp52-pcj8-j9qc","identifiers":["GHSA-vp52-pcj8-j9qc","CVE-2026-84304","GO-2026-6348"]},"retained":false,"historicalAffected":[]},{"revision":"4ef8e8f81ee24bf5aaed076dde67d488","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GO-2026-6348","aliases":["CVE-2026-84304","GHSA-vp52-pcj8-j9qc"],"title":"Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc","description":"Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc","state":0,"publishedAt":"2026-09-15T18:39:25+00:00","modifiedAt":"2026-09-15T19:00:16.9446632+00:00","affected":[{"ecosystem":"Go","name":"google.golang.org/grpc","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.83.1"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[],"references":["https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc","https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176","https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77","https://github.com/grpc/grpc-go/pull/9331","https://github.com/grpc/grpc-go/pull/9333","https://github.com/grpc/grpc-go/releases/tag/v1.83.1"],"sourceUrl":"https://osv.dev/vulnerability/GO-2026-6348","license":"OSV · upstream source license applies","key":"osv:GO-2026-6348","identifiers":["GO-2026-6348","CVE-2026-84304","GHSA-vp52-pcj8-j9qc"]},"retained":false,"historicalAffected":[]}],"coverage":[{"source":"cisa-kev:global","scope":"Complete CISA KEV catalog; all vendors. Missing entries do not establish absence of exploitation.","generation":"2026-11-13T12:59:11.9732431+00:00","complete":true,"records":1779,"lastAttemptAt":"2026-11-13T12:59:11.9732431+00:00","lastSuccessAt":"2026-11-13T12:59:12.1229749+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:12.1229756+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"cve-program","scope":"Official CVE Program baseline and cumulative hourly delta; all vendors, published and rejected records","generation":"cve-d8fa82e95fdb59244e2f635e667ba17f0796ca0a4f1f4bb8cc31febcd660b76c-f139040820e198a7b90c89ade0a85e4d1784f6cdedc33dd35667c553a90ed9b3","complete":true,"records":425359,"lastAttemptAt":"2026-11-13T12:57:12.1370926+00:00","lastSuccessAt":"2026-11-13T12:57:12.0535039+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:57:12.1370926+00:00","snapshotPublishedAt":"2026-11-13T12:35:15+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"euvd","scope":"Rolling EUVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global EUVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-8106b486b70c4e0a972457e9bec940ae","complete":false,"records":13795,"lastAttemptAt":"2026-11-13T13:08:46.7498468+00:00","lastSuccessAt":"2026-11-13T13:08:46.746+00:00","error":"412 identifier lookups failed; latest failures include AccessDenied (HTTP 403). Other identifiers were checked independently.","lastVerifiedAt":"2026-11-13T13:08:46.746+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13087,"expectedIdentifiers":13848,"failedIdentifiers":412},{"source":"first-epss:nuget","scope":"FIRST EPSS for explicit CVE aliases in the collected public NuGet archive. Not a global EPSS backfill.","generation":"2026-11-13T12:59:11.9732431+00:00","complete":true,"records":1123,"lastAttemptAt":"2026-11-13T12:59:11.9732431+00:00","lastSuccessAt":"2026-11-13T12:59:12.1237796+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:12.1237798+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"nvd","scope":"Rolling NVD lookups of CVE aliases in current public OSV archives; 500 identifiers per refresh, rechecked after 48 hours. Not a global NVD catalog. Successful not-found lookups count as checked; they do not imply withdrawal or safety. No reader inventory is sent.","generation":"enrichment-18b27772e3264b22ab6b919eb23a22fd","complete":true,"records":13795,"lastAttemptAt":"2026-11-13T12:59:14.4637385+00:00","lastSuccessAt":"2026-11-13T12:59:14.459+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:14.459+00:00","snapshotPublishedAt":null,"importing":false,"stagedRecords":0,"checkedIdentifiers":13848,"expectedIdentifiers":13848,"failedIdentifiers":0},{"source":"osv:Go","scope":"Complete OSV Go ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"go-93e76d404e1aeb6a7e8902f5ffa06211fc86dea3b1958e297abb2668aa5e6e8c","complete":true,"records":9952,"lastAttemptAt":"2026-11-13T12:59:07.8110438+00:00","lastSuccessAt":"2026-11-12T23:19:15.5239119+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:07.8110438+00:00","snapshotPublishedAt":"2026-11-12T23:03:02+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:NuGet","scope":"Complete OSV NuGet ecosystem archive, including GitHub Advisory Database records; NuGet version matching only","generation":"nuget-4d60731753a2f72e455d1086e7203d0ef10843936dcc1cf2b45135e2caa204b0","complete":true,"records":2012,"lastAttemptAt":"2026-11-13T12:57:12.2985214+00:00","lastSuccessAt":"2026-11-12T18:16:50.7862525+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:57:12.2985214+00:00","snapshotPublishedAt":"2026-11-12T17:48:11+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:crates.io","scope":"Complete OSV crates.io ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"crates.io-ab4ad5f59937c0596645e186474e26d2fffbbe6ecc09983ad71f9a0d88918405","complete":true,"records":3129,"lastAttemptAt":"2026-11-13T12:59:11.9406927+00:00","lastSuccessAt":"2026-11-13T12:59:11.7864534+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:11.9406927+00:00","snapshotPublishedAt":"2026-11-13T12:47:49+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null},{"source":"osv:npm","scope":"Complete OSV npm ecosystem archive, including withdrawn and malicious-package source records; statement counts are not unique CVE counts","generation":"npm-7d9437160a3664a4238cadabbe17e78db87dde648ca4c671841d50155dfa5d6c","complete":true,"records":231770,"lastAttemptAt":"2026-11-13T12:59:07.6810383+00:00","lastSuccessAt":"2026-11-13T12:59:06.1905777+00:00","error":null,"lastVerifiedAt":"2026-11-13T12:59:07.6810383+00:00","snapshotPublishedAt":"2026-11-13T12:33:13+00:00","importing":false,"stagedRecords":0,"checkedIdentifiers":null,"expectedIdentifiers":null,"failedIdentifiers":null}]}