Exploit discussion active in current signal (2 latest mentions)
Recommended action window: High priority (within 72h)
NVD description
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, internal/transport/transport.go stores each fragmented HTTP/2 DATA frame as a separate recvMsg in recvBuffer, so millions of one-byte frames can consume disproportionate heap memory even when payload bytes remain within connection and stream flow-control windows. An unauthenticated remote attacker can use concurrent multiplexed streams to exhaust process memory and cause a runtime panic or out-of-memory termination. Receive-buffer compaction is enabled by default and can be controlled temporarily with GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION. This issue is fixed in version 1.83.1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
CVE-2026-6790 CVE-2026-68497 CVE-2026-83557 N/A Security fixes for apigee-prom-prometheus. This addresses the following vulnerabilities: CVE-2026-84303 CVE-2026-84304 N/A Security fixes for apigee-prometheus-adapter 9/16
CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-81870 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 N/A Security fixes for apigee-mart-server. This addresses the following vulnerabilities: CVE-2024-6763 CVE-2025-46392 CVE-2026-10050 7/16
Our CTI team identified a lot of activities targeting gRPC-Go (CVE-2026-84304) https://vuldb.com/vuln/397800/cti
Post summary
The CTI team reported detecting numerous activities targeting the gRPC-Go CVE-2026-84304, but no further technical or exploit details were provided.
NewNormal Security turns the last 24 hours of CVEs into new detections, every day. 𝗗𝗮𝗶𝗹𝘆 𝗖𝗩𝗘 𝗥𝗲𝗽𝗼𝗿𝘁 — 2 Sep 2026 𝗔𝗱𝗱𝗲𝗱 to NewScan 𝘁𝗼𝗱𝗮𝘆: 📦 Vulnerable XML parser version — crafted end tags can stall the Node.js event loop (xmldom CVE-2026-83619) 📦 Vulnerable gRPC library version — fragmented HTTP/2 frames can exhaust server memory (gRPC-Go CVE-2026-84304) Test your stack with NewScan — free, self-hosted: https://newnormalsecurity.com/newscan?utm_source=x&utm_medium=social&utm_campaign=daily-cve #infosec #AppSec #DoS #CSO #REDTEAM
Post summary
The tweet lists two new CVEs with detailed impact descriptions and suggests testing with NewScan; it does not provide PoCs, exploits, patches, or evidence of active attacks.
🚨High - gRPC-Go HTTP/2 DATA Fragmentation Memory Exhaustion DoS (CVE-2026-84304) In gRPC-Go, fragmented HTTP/2 DATA frames are stored as separate receive messages; an unauthenticated attacker can send millions of tiny frames across multiplexed concurrent streams to bloat heap within flow-control windows and trigger OOM/runtime panic (remote DoS). Fixed by default receive-buffer compaction (GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION). 👉Affected: http://google.golang.org/grpc < 1.83.1 | Upgrade to 1.83.1
Post summary
A new high‑severity DoS vulnerability (CVE‑2026‑84304) in gRPC-Go allows unauthenticated attackers to trigger memory exhaustion via fragmented HTTP/2 DATA frames; the issue is fixed in version 1.83.1 with default receive‑buffer compaction enabled.
🔴 gRPC-Go, Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation, #CVE-2026-84304 (High) -DC-Sep2026-2077 https://dailycve.com/grpc-go-heap-memory-exhaustion-oom-via-http-2-data-frame-fragmentation-cve-2026-84304-high-dc-sep2026-2077/
Post summary
The post announces a high‑severity heap memory exhaustion bug in gRPC‑Go (CVE-2026-84304), offering a brief technical description but no PoC, exploit code, or patch information.