https://vulnerability.circl.lu/sightings/feed 2026-09-04T08:34:27.882107+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/fa6087ad-4b31-4ae3-8e8e-6af18ec3ea51/export 2026-09-04T08:34:27.903481+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "fa6087ad-4b31-4ae3-8e8e-6af18ec3ea51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117201768874255726", "content": "Our CTI team identified a lot of activities targeting gRPC-Go (CVE-2026-84304) https://vuldb.com/vuln/397800/cti", "creation_timestamp": "2026-09-02T13:51:09.484325Z"} 2026-09-02T13:51:09.484325+00:00 https://vulnerability.circl.lu/sighting/ef91842b-5a0b-4f80-a86b-d3f5c77da5da/export 2026-09-04T08:34:27.905530+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "ef91842b-5a0b-4f80-a86b-d3f5c77da5da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://gist.github.com/alon710/422f915c96f67cc1c9fceb7d3c2778a9", "content": "# CVE-2026-84304: CVE-2026-84304: Uncontrolled Resource Consumption in gRPC-Go HTTP/2 Frame Processing\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84304\n\n## Summary\nCVE-2026-84304 is a high-severity uncontrolled resource consumption vulnerability in gRPC-Go, the Go implementation of the gRPC framework. The issue stems from a memory amplification flaw inside the HTTP/2 DATA frame processing subsystem. Remote, unauthenticated attackers can exploit this vulnerability by sending a high volume of heavily fragmented, tiny DATA frames within multiplexed concurrent streams. This causes gRPC-Go servers to allocate excessive internal metadata structures on the Go heap, leading to severe heap memory amplification, intense garbage collection thrashing, and process termination due to Out-of-Memory (OOM) conditions.\n\n## TL;DR\nAn unauthenticated remote attacker can crash gRPC-Go servers (prior to version 1.83.1) by sending millions of fragmented, 1-byte HTTP/2 DATA frames. This bypasses standard flow control limits, forcing excessive metadata allocation on the heap and leading to Out-of-Memory (OOM) crashes.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7\n- **Vulnerability Type**: Uncontrolled Resource Consumption\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- gRPC-Go applications utilizing transport layers prior to version 1.83.1.\n- **gRPC-Go**: < 1.83.1 (Fixed in: `1.83.1`)\n\n## Mitigation\n\n- Upgrade gRPC-Go library dependencies to version 1.83.1 or later.\n- Enforce minimum HTTP/2 frame size limits via an edge proxy or WAF.\n- Limit concurrent HTTP/2 streams per connection using gRPC server configuration parameters.\n- Do not set GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION to false in production environments.\n\n**Remediation Steps:**\n1. Open the project's go.mod file and locate the google.golang.org/grpc dependency.\n2. Run the command: go get google.golang.org/grpc@v1.83.1.\n3. Execute go mod tidy to update the dependency tree and verify the checksums in go.sum.\n4. Recompile all dependent application binaries and redeploy the updated services into production.\n5. Verify that the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION is not disabled in the deployment templates.\n\n## References\n\n- [GitHub Security Advisory GHSA-vp52-pcj8-j9qc](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc)\n- [Fix Commit - Buffer Compaction Implementation](https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176)\n- [Cherry-pick Commit to v1.83.x Release Branch](https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77)\n- [gRPC-Go Pull Request #9331](https://github.com/grpc/grpc-go/pull/9331)\n- [gRPC-Go Pull Request #9333](https://github.com/grpc/grpc-go/pull/9333)\n- [gRPC-Go Release v1.83.1 Tag](https://github.com/grpc/grpc-go/releases/tag/v1.83.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84304) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T00:00:27.054692Z"} 2026-09-02T00:00:27.054692+00:00 https://vulnerability.circl.lu/sighting/6dda4458-23cd-4866-a778-d214733b1ad7/export 2026-09-04T08:34:27.905642+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "6dda4458-23cd-4866-a778-d214733b1ad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://gist.github.com/alon710/422f915c96f67cc1c9fceb7d3c2778a9", "content": "# CVE-2026-84304: CVE-2026-84304: Uncontrolled Resource Consumption in gRPC-Go HTTP/2 Frame Processing\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84304\n\n## Summary\nCVE-2026-84304 is a high-severity uncontrolled resource consumption vulnerability in gRPC-Go, the Go implementation of the gRPC framework. The issue stems from a memory amplification flaw inside the HTTP/2 DATA frame processing subsystem. Remote, unauthenticated attackers can exploit this vulnerability by sending a high volume of heavily fragmented, tiny DATA frames within multiplexed concurrent streams. This causes gRPC-Go servers to allocate excessive internal metadata structures on the Go heap, leading to severe heap memory amplification, intense garbage collection thrashing, and process termination due to Out-of-Memory (OOM) conditions.\n\n## TL;DR\nAn unauthenticated remote attacker can crash gRPC-Go servers (prior to version 1.83.1) by sending millions of fragmented, 1-byte HTTP/2 DATA frames. This bypasses standard flow control limits, forcing excessive metadata allocation on the heap and leading to Out-of-Memory (OOM) crashes.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7\n- **Vulnerability Type**: Uncontrolled Resource Consumption\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- gRPC-Go applications utilizing transport layers prior to version 1.83.1.\n- **gRPC-Go**: < 1.83.1 (Fixed in: `1.83.1`)\n\n## Mitigation\n\n- Upgrade gRPC-Go library dependencies to version 1.83.1 or later.\n- Enforce minimum HTTP/2 frame size limits via an edge proxy or WAF.\n- Limit concurrent HTTP/2 streams per connection using gRPC server configuration parameters.\n- Do not set GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION to false in production environments.\n\n**Remediation Steps:**\n1. Open the project's go.mod file and locate the google.golang.org/grpc dependency.\n2. Run the command: go get google.golang.org/grpc@v1.83.1.\n3. Execute go mod tidy to update the dependency tree and verify the checksums in go.sum.\n4. Recompile all dependent application binaries and redeploy the updated services into production.\n5. Verify that the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION is not disabled in the deployment templates.\n\n## References\n\n- [GitHub Security Advisory GHSA-vp52-pcj8-j9qc](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc)\n- [Fix Commit - Buffer Compaction Implementation](https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176)\n- [Cherry-pick Commit to v1.83.x Release Branch](https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77)\n- [gRPC-Go Pull Request #9331](https://github.com/grpc/grpc-go/pull/9331)\n- [gRPC-Go Pull Request #9333](https://github.com/grpc/grpc-go/pull/9333)\n- [gRPC-Go Release v1.83.1 Tag](https://github.com/grpc/grpc-go/releases/tag/v1.83.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84304) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T22:31:39.110414Z"} 2026-09-01T22:31:39.110414+00:00 https://vulnerability.circl.lu/sighting/19c0f8cf-7517-48e8-b3dc-33aa9bb7843f/export 2026-09-04T08:34:27.905726+00:00 Automation user https://vulnerability.circl.lu/user/automation {"uuid": "19c0f8cf-7517-48e8-b3dc-33aa9bb7843f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3muih6g74sa2j", "content": "CVE-2026-84304, high, in gRPC-Go: an unauthenticated caller can fragment a stream payload into millions of 1-byte HTTP/2 DATA frames and exhaust the heap. The advisory notes each fragment carries tracking overhead, so flow-control windows do not bound it. #dev", "creation_timestamp": "2026-09-01T22:17:30.331147Z"} 2026-09-01T22:17:30.331147+00:00