gRPC-Go is the Go language implementation of gRPC.

CVE-2026-84304 is a denial-of-service vulnerability in google.golang.org/grpc versions ≤ 1.83.0. The flaw lives in internal/transport/transport.go, where each incoming HTTP/2 DATA frame is stored as a separate recvMsg in a recvBuffer. An unauthenticated remote attacker opens a gRPC stream and fragments their payload into millions of 1-byte HTTP/2 DATA frames. Because the total payload stays within HTTP/2 flow-control windows, the server happily accepts the frames — but each tiny frame carries per-message heap overhead from internal tracking structures and queue allocation. By multiplexing hundreds of concurrent streams, an attacker forces the Go runtime into an out-of-memory panic, killing the process. The fix in 1.83.1 introduces receive-buffer compaction that coalesces small fragments automatically.

The GitHub Security Advisory (GHSA-vp52-pcj8-j9qc) rates this HIGH, and the GitLab Advisory Database assigns CVSS:3.1 7.5 — both appropriate for an unauthenticated, zero-interaction, zero-complexity remote DoS with no confidentiality or integrity impact. The CVSSv4 score of 8.7 seen in some aggregators is mechanically inflated by the v4 scoring algorithm for network-reachable availability impacts; the 7.5 v3.1 score better reflects operational reality. The DoS-only impact ceiling means this cannot justify CRITICAL unless the affected component canonically serves a fleet-control or identity role — and while gRPC-Go *is* embedded in Kubernetes and service-mesh control planes, the blast radius is service restart, not domain takeover.

1. Upgrade google.golang.org/grpc to ≥ 1.83.1 in all Go modules — The definitive fix. Run go get google.golang.org/[email protected] and rebuild. Receive-buffer compaction is enabled by default in 1.83.1, coalescing small frames to eliminate the amplification. Per the noisgate remediation SLA for HIGH, deploy the patched version within 180 days.
2. Set Kubernetes memory limits on all gRPC-serving pods — Add resources.limits.memory to pod specs so OOM-kill is scoped to the pod, not the node. The pod restarts automatically via the kubelet. This converts a potential host-level outage into a brief pod restart. Deploy within 30 days per noisgate mitigation SLA for HIGH.
3. Enforce connection and stream limits at the reverse proxy — Configure Envoy, nginx, or HAProxy to cap max_concurrent_streams (e.g., 50), max_connections_per_source_ip, and max_requests_per_connection. This limits the attacker's ability to open enough streams to trigger OOM. Many service-mesh configurations already enforce these defaults.
4. Enable mTLS on gRPC listeners — Require mutual TLS at the transport layer so only authenticated clients can establish HTTP/2 connections. In Istio, set PeerAuthentication to STRICT mode. This eliminates unauthenticated attackers from the threat model entirely. Does not protect against compromised internal identities.
5. Monitor process memory and set OOM alerting — Alert on go_memstats_heap_alloc_bytes exceeding 2x normal baseline and on container_oom_events_total incrementing. This does not prevent exploitation but ensures rapid detection and response. Pair with runbook for pod restart and attacker-source blocking.

Run this script on each host or in each container image's CI pipeline where a Go binary imports google.golang.org/grpc. It checks go.sum or the compiled binary's module info. Requires read access to the project directory. Example: bash check_cve_2026_84304.sh /path/to/go/project

#!/usr/bin/env bash
# CVE-2026-84304 Checker — gRPC-Go OOM via HTTP/2 DATA Frame Fragmentation
# Usage: bash check_cve_2026_84304.sh <path-to-go-project-or-binary>
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -uo pipefail

FIXED_VERSION="1.83.1"
TARGET="${1:-}"

if [ -z "$TARGET" ]; then
  echo "Usage: $0 <path-to-go-project-or-binary>"
  echo "UNKNOWN — no target specified"
  exit 2
fi

version_gte() {
  # Returns 0 if $1 >= $2 using sort -V
  [ "$(printf '%s\n%s' "$1" "$2" | sort -V | head -n1)" = "$2" ]
}

# Strategy 1: Check go.sum in a Go module project
if [ -d "$TARGET" ]; then
  GOSUM="$TARGET/go.sum"
  GOMOD="$TARGET/go.mod"
  FOUND_VERSION=""

  if [ -f "$GOSUM" ]; then
    # Extract the highest grpc-go version from go.sum
    FOUND_VERSION=$(grep -oP 'google\.golang\.org/grpc v\K[0-9]+\.[0-9]+\.[0-9]+' "$GOSUM" \
      | sort -V | tail -n1)
  elif [ -f "$GOMOD" ]; then
    FOUND_VERSION=$(grep -oP 'google\.golang\.org/grpc v\K[0-9]+\.[0-9]+\.[0-9]+' "$GOMOD" \
      | sort -V | tail -n1)
  fi

  if [ -z "$FOUND_VERSION" ]; then
    echo "UNKNOWN — google.golang.org/grpc not found in $TARGET"
    exit 2
  fi

  if version_gte "$FOUND_VERSION" "$FIXED_VERSION"; then
    echo "PATCHED — google.golang.org/grpc v$FOUND_VERSION >= v$FIXED_VERSION"
    exit 0
  else
    echo "VULNERABLE — google.golang.org/grpc v$FOUND_VERSION < v$FIXED_VERSION (CVE-2026-84304)"
    exit 1
  fi
fi

# Strategy 2: Check a compiled Go binary's embedded module info
if [ -f "$TARGET" ] && file "$TARGET" | grep -qiE 'ELF|Mach-O|PE32'; then
  if ! command -v go >/dev/null 2>&1; then
    echo "UNKNOWN — 'go' tool not in PATH, cannot inspect binary module info"
    exit 2
  fi

  MOD_INFO=$(go version -m "$TARGET" 2>/dev/null || true)
  FOUND_VERSION=$(echo "$MOD_INFO" \
    | grep -oP 'google\.golang\.org/grpc\s+v\K[0-9]+\.[0-9]+\.[0-9]+' \
    | sort -V | tail -n1)

  if [ -z "$FOUND_VERSION" ]; then
    echo "UNKNOWN — google.golang.org/grpc not found in binary module info"
    exit 2
  fi

  if version_gte "$FOUND_VERSION" "$FIXED_VERSION"; then
    echo "PATCHED — google.golang.org/grpc v$FOUND_VERSION >= v$FIXED_VERSION"
    exit 0
  else
    echo "VULNERABLE — google.golang.org/grpc v$FOUND_VERSION < v$FIXED_VERSION (CVE-2026-84304)"
    exit 1
  fi
fi

echo "UNKNOWN — target is not a directory or recognized binary: $TARGET"
exit 2

1. GitHub Security Advisory (GHSA-vp52-pcj8-j9qc)
2. GitLab Advisory Database — CVE-2026-84304
3. Go Vulnerability Database — GO-2026-6348
4. gRPC-Go PR #9331 — Restrict memory overhead of buffering small data frames
5. CVE Record — CVE-2026-84304
6. CyberStrike CVE Detail — CVE-2026-84304
7. DailyCVE — gRPC-Go Heap Memory Exhaustion