{"vulnerability": "cve-2026-8430", "sightings": [{"uuid": "19c0f8cf-7517-48e8-b3dc-33aa9bb7843f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/thestandup.bsky.social/post/3muih6g74sa2j", "content": "CVE-2026-84304, high, in gRPC-Go: an unauthenticated caller can fragment a stream payload into millions of 1-byte HTTP/2 DATA frames and exhaust the heap. The advisory notes each fragment carries tracking overhead, so flow-control windows do not bound it. #dev", "creation_timestamp": "2026-09-01T22:17:30.331147Z"}, {"uuid": "6dda4458-23cd-4866-a778-d214733b1ad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://gist.github.com/alon710/422f915c96f67cc1c9fceb7d3c2778a9", "content": "# CVE-2026-84304: CVE-2026-84304: Uncontrolled Resource Consumption in gRPC-Go HTTP/2 Frame Processing\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84304\n\n## Summary\nCVE-2026-84304 is a high-severity uncontrolled resource consumption vulnerability in gRPC-Go, the Go implementation of the gRPC framework. The issue stems from a memory amplification flaw inside the HTTP/2 DATA frame processing subsystem. Remote, unauthenticated attackers can exploit this vulnerability by sending a high volume of heavily fragmented, tiny DATA frames within multiplexed concurrent streams. This causes gRPC-Go servers to allocate excessive internal metadata structures on the Go heap, leading to severe heap memory amplification, intense garbage collection thrashing, and process termination due to Out-of-Memory (OOM) conditions.\n\n## TL;DR\nAn unauthenticated remote attacker can crash gRPC-Go servers (prior to version 1.83.1) by sending millions of fragmented, 1-byte HTTP/2 DATA frames. This bypasses standard flow control limits, forcing excessive metadata allocation on the heap and leading to Out-of-Memory (OOM) crashes.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7\n- **Vulnerability Type**: Uncontrolled Resource Consumption\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- gRPC-Go applications utilizing transport layers prior to version 1.83.1.\n- **gRPC-Go**: < 1.83.1 (Fixed in: `1.83.1`)\n\n## Mitigation\n\n- Upgrade gRPC-Go library dependencies to version 1.83.1 or later.\n- Enforce minimum HTTP/2 frame size limits via an edge proxy or WAF.\n- Limit concurrent HTTP/2 streams per connection using gRPC server configuration parameters.\n- Do not set GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION to false in production environments.\n\n**Remediation Steps:**\n1. Open the project's go.mod file and locate the google.golang.org/grpc dependency.\n2. Run the command: go get google.golang.org/grpc@v1.83.1.\n3. Execute go mod tidy to update the dependency tree and verify the checksums in go.sum.\n4. Recompile all dependent application binaries and redeploy the updated services into production.\n5. Verify that the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION is not disabled in the deployment templates.\n\n## References\n\n- [GitHub Security Advisory GHSA-vp52-pcj8-j9qc](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc)\n- [Fix Commit - Buffer Compaction Implementation](https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176)\n- [Cherry-pick Commit to v1.83.x Release Branch](https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77)\n- [gRPC-Go Pull Request #9331](https://github.com/grpc/grpc-go/pull/9331)\n- [gRPC-Go Pull Request #9333](https://github.com/grpc/grpc-go/pull/9333)\n- [gRPC-Go Release v1.83.1 Tag](https://github.com/grpc/grpc-go/releases/tag/v1.83.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84304) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T22:31:39.110414Z"}, {"uuid": "f9325f10-ba41-4778-9d4a-cfa3eb83ee73", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84305", "type": "published-proof-of-concept", "source": "https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm", "content": "", "creation_timestamp": "2026-09-01T22:35:02.814081Z"}, {"uuid": "ef91842b-5a0b-4f80-a86b-d3f5c77da5da", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://gist.github.com/alon710/422f915c96f67cc1c9fceb7d3c2778a9", "content": "# CVE-2026-84304: CVE-2026-84304: Uncontrolled Resource Consumption in gRPC-Go HTTP/2 Frame Processing\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84304\n\n## Summary\nCVE-2026-84304 is a high-severity uncontrolled resource consumption vulnerability in gRPC-Go, the Go implementation of the gRPC framework. The issue stems from a memory amplification flaw inside the HTTP/2 DATA frame processing subsystem. Remote, unauthenticated attackers can exploit this vulnerability by sending a high volume of heavily fragmented, tiny DATA frames within multiplexed concurrent streams. This causes gRPC-Go servers to allocate excessive internal metadata structures on the Go heap, leading to severe heap memory amplification, intense garbage collection thrashing, and process termination due to Out-of-Memory (OOM) conditions.\n\n## TL;DR\nAn unauthenticated remote attacker can crash gRPC-Go servers (prior to version 1.83.1) by sending millions of fragmented, 1-byte HTTP/2 DATA frames. This bypasses standard flow control limits, forcing excessive metadata allocation on the heap and leading to Out-of-Memory (OOM) crashes.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7\n- **Vulnerability Type**: Uncontrolled Resource Consumption\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- gRPC-Go applications utilizing transport layers prior to version 1.83.1.\n- **gRPC-Go**: < 1.83.1 (Fixed in: `1.83.1`)\n\n## Mitigation\n\n- Upgrade gRPC-Go library dependencies to version 1.83.1 or later.\n- Enforce minimum HTTP/2 frame size limits via an edge proxy or WAF.\n- Limit concurrent HTTP/2 streams per connection using gRPC server configuration parameters.\n- Do not set GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION to false in production environments.\n\n**Remediation Steps:**\n1. Open the project's go.mod file and locate the google.golang.org/grpc dependency.\n2. Run the command: go get google.golang.org/grpc@v1.83.1.\n3. Execute go mod tidy to update the dependency tree and verify the checksums in go.sum.\n4. Recompile all dependent application binaries and redeploy the updated services into production.\n5. Verify that the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION is not disabled in the deployment templates.\n\n## References\n\n- [GitHub Security Advisory GHSA-vp52-pcj8-j9qc](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc)\n- [Fix Commit - Buffer Compaction Implementation](https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176)\n- [Cherry-pick Commit to v1.83.x Release Branch](https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77)\n- [gRPC-Go Pull Request #9331](https://github.com/grpc/grpc-go/pull/9331)\n- [gRPC-Go Pull Request #9333](https://github.com/grpc/grpc-go/pull/9333)\n- [gRPC-Go Release v1.83.1 Tag](https://github.com/grpc/grpc-go/releases/tag/v1.83.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84304) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T00:00:27.054692Z"}, {"uuid": "eae8aab1-ba7e-4899-8f81-6bd393df7042", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84306", "type": "seen", "source": "https://gist.github.com/alon710/f0327fbec515b265e501091e4bb41d35", "content": "# CVE-2026-84306: CVE-2026-84306: Multi-Factor Authentication Bypass via Replay Attack in Filament\n\n> **CVSS Score:** 6.5\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84306\n\n## Summary\nA multi-factor authentication bypass vulnerability exists in Filament (Laravel full-stack framework panels) due to improper time-step tracking of Time-Based One-Time Password (TOTP) codes. By submitting valid TOTP codes from an older time window within the drift allowance, an attacker with a user's password can bypass the single-use MFA guarantee and obtain unauthorized account access.\n\n## TL;DR\nFilament's TOTP verification allowed the replay of older valid codes within the drift window because it tracked used codes individually rather than globally tracking the last accepted timestep. This allowed an attacker with compromised passwords to bypass multi-factor authentication.\n\n## Technical Details\n\n- **CWE ID**: CWE-294\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 6.5\n- **Exploit Status**: None/Unproven\n- **CISA KEV Status**: Not Listed\n- **Vulnerability Type**: Authentication Bypass by Capture-replay\n\n## Affected Systems\n\n- Filament Framework Panels\n- **Filament**: >= 4.0.0, < 4.12.6 (Fixed in: `4.12.6`)\n- **Filament**: >= 5.0.0, < 5.7.6 (Fixed in: `5.7.6`)\n\n## Mitigation\n\n- Upgrade Filament to version 4.12.6 or 5.7.6\n- Configure a lock-supporting cache driver such as Redis or Memcached in production to ensure concurrency locking.\n- Reduce the clock drift window to the minimum acceptable value to narrow the reuse window.\n\n**Remediation Steps:**\n1. 1. Identify the current version of Filament used in your project by inspecting your composer.json file.\n2. 2. Execute 'composer update filament/filament:^4.12.6' or 'composer update filament/filament:^5.7.6' to install the secure release.\n3. 3. Ensure that your CACHE_DRIVER in your .env file is set to 'redis', 'memcached', or another store that implements LockProvider.\n4. 4. Run 'php artisan cache:clear' to clean legacy cache entries.\n5. 5. Monitor log files for any unauthorized MFA logins or lock-related failures.\n\n## References\n\n- [GitHub Security Advisory GHSA-r3j6-gpjw-qfjr](https://github.com/filamentphp/filament/security/advisories/GHSA-r3j6-gpjw-qfjr)\n- [CVE-2026-84306 on CVE.org](https://www.cve.org/CVERecord?id=CVE-2026-84306)\n- [Official Patch Commit](https://github.com/filamentphp/filament/commit/b6bde8572bcac75d4f5b4ec892ba7b9e91e0ab4d)\n- [Official Pull Request](https://github.com/filamentphp/filament/pull/20335)\n- [Filament v4.12.6 Release Notes](https://github.com/filamentphp/filament/releases/tag/v4.12.6)\n- [Filament v5.7.6 Release Notes](https://github.com/filamentphp/filament/releases/tag/v5.7.6)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84306) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T00:32:16.866612Z"}, {"uuid": "64a158ac-f8ff-4859-8c76-a3ee936ac1bc", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84307", "type": "seen", "source": "https://gist.github.com/alon710/c47c604ce50ae0fa194515af5d7d206b", "content": "# CVE-2026-84307: CVE-2026-84307: Authentication Oracle and Multi-Factor Authentication Challenge Leak in Filament\n\n> **CVSS Score:** 3.7\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84307\n\n## Summary\nAn authentication oracle vulnerability exists in Filament before 4.12.5 and 5.7.5. The application initiates MFA challenge workflows prior to verifying user authorization policies, allowing unauthenticated attackers to validate guessed credentials.\n\n## TL;DR\nFilament leaked credential validity by triggering MFA flows before verifying user authorization checks.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-204\n- **Attack Vector**: Network\n- **CVSS v3.1 Score**: 3.7 (Low)\n- **EPSS Score**: Not Available\n- **Impact**: Credential Enumeration / Information Disclosure\n- **Exploit Status**: Proof of Concept\n- **KEV Status**: Not Listed\n\n## Affected Systems\n\n- filamentphp/filament\n- **Filament**: >= 4.0.0, < 4.12.5 (Fixed in: `4.12.5`)\n- **Filament**: >= 5.0.0, < 5.7.5 (Fixed in: `5.7.5`)\n\n## Mitigation\n\n- Upgrade Filament to version 4.12.5 or 5.7.5\n- Implement strict rate limiting on the login endpoints\n- Monitor outbound MFA email notifications for anomalous surges\n\n**Remediation Steps:**\n1. Run 'composer update filament/filament' to retrieve the latest secure package versions.\n2. Verify the installed version in composer.lock is at least 4.12.5 or 5.7.5.\n3. Deploy the updated application to production environments.\n\n## References\n\n- [NVD CVE-2026-84307 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-84307)\n- [GitHub Security Advisory GHSA-xwpv-pqxp-5v36](https://github.com/filamentphp/filament/security/advisories/GHSA-xwpv-pqxp-5v36)\n- [Filament Pull Request #20308](https://github.com/filamentphp/filament/pull/20308)\n- [Fix Commit ad5aacbc6d089b3dd7243ec1c1f8ab19dff7c3a1](https://github.com/filamentphp/filament/commit/ad5aacbc6d089b3dd7243ec1c1f8ab19dff7c3a1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84307) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T01:32:29.488547Z"}, {"uuid": "aaf9a0e5-999a-4b20-9f95-a9f4d8820fbe", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84309", "type": "seen", "source": "https://gist.github.com/alon710/d55e9844c43e78f042db258784a22ae0", "content": "# CVE-2026-84309: CVE-2026-84309: Infinite Loop and CPU Exhaustion in pypdf TreeObject.insert_child\n\n> **CVSS Score:** 6.9\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84309\n\n## Summary\nAn infinite loop vulnerability in pypdf versions prior to 6.16.0 allows attackers to trigger computational resource exhaustion and complete thread locking by supplying a malformed PDF with a cyclic tree structure. When modifying or rewriting document outlines containing circular references, the library endlessly traverses /Next pointers, resulting in application denial of service.\n\n## TL;DR\nInfinite loop (CWE-835) in pypdf < 6.16.0 allows unauthenticated attackers to cause complete CPU exhaustion (DoS) via crafted PDF structures containing cyclic tree relationships.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-835\n- **Attack Vector**: Local (AV:L) / Indirectly Network\n- **CVSS v4.0 Score**: 6.9\n- **Exploit Status**: poc\n- **CISA KEV Status**: Not Listed\n- **Impact**: Denial of Service (CPU Exhaustion)\n\n## Affected Systems\n\n- pypdf Python library versions prior to 6.16.0\n- Python backend services processing PDF outlines, merges, or page updates\n- SaaS applications accepting untrusted user-uploaded PDF documents\n- **pypdf**: < 6.16.0 (Fixed in: `6.16.0`)\n\n## Mitigation\n\n- Upgrade the pypdf library to version 6.16.0 or higher.\n- Configure aggressive CPU and memory timeouts on document-parsing worker processes.\n- Enforce execution limits at the process container or task runner level (e.g., Celery, Gunicorn limits).\n\n**Remediation Steps:**\n1. Identify all deployment containers and virtual environments containing pypdf.\n2. Execute 'pip install --upgrade pypdf>=6.16.0' to implement the fix.\n3. Confirm that pypdf environments are running the safe version via 'python -c \"import pypdf; print(pypdf.__version__)\"'.\n4. Implement and test processing timeouts on incoming file uploads.\n\n## References\n\n- [GitHub Security Advisory GHSA-jp53-mhqp-8xcg](https://github.com/py-pdf/pypdf/security/advisories/GHSA-jp53-mhqp-8xcg)\n- [CVE-2026-84309 Record](https://www.cve.org/CVERecord?id=CVE-2026-84309)\n- [pypdf Pull Request #3964](https://github.com/py-pdf/pypdf/pull/3964)\n- [Fix Commit c9ba557](https://github.com/py-pdf/pypdf/commit/c9ba557d565d57c53a0b3a0be06c0a4c29b0559b)\n- [pypdf 6.16.0 Release Tag](https://github.com/py-pdf/pypdf/releases/tag/6.16.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84309) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T05:32:13.234930Z"}, {"uuid": "c2c46d9b-afa8-4fbd-8bc6-1dac6ea44690", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84305", "type": "seen", "source": "https://gist.github.com/alon710/342832b227e98d6656ed29633e96b4ab", "content": "# CVE-2026-84305: CVE-2026-84305: Algorithmic Complexity Vulnerability (ReindentFilter CPU Exhaustion) in sqlparse\n\n> **CVSS Score:** 5.1\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84305\n\n## Summary\nAn algorithmic complexity vulnerability in the python sqlparse library versions before 0.6.0 allows an attacker to cause high CPU usage and denial of service via a crafted SQL statement during formatting.\n\n## TL;DR\nThe sqlparse library contains an O(N^2) complexity flaw in its reindentation filter, allowing small crafted SQL payloads to trigger CPU exhaustion and denial of service.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-407\n- **Attack Vector**: Local / Remote (via untrusted SQL input formatting)\n- **CVSS v4.0 Score**: 5.1\n- **Exploit Maturity**: Proof-of-Concept\n- **KEV Status**: Not Listed\n- **Ransomware Association**: No\n\n## Affected Systems\n\n- sqlparse (Python package)\n- **sqlparse**: < 0.6.0 (Fixed in: `0.6.0`)\n\n## Mitigation\n\n- Upgrade sqlparse to version 0.6.0 or newer.\n- Disable the opt-in 'reindent=True' formatting parameter when handling untrusted user input.\n\n**Remediation Steps:**\n1. Identify all Python environments running sqlparse versions older than 0.6.0.\n2. Execute 'pip install --upgrade sqlparse>=0.6.0' to upgrade the package.\n3. Audit application source code for instances of 'sqlparse.format(..., reindent=True)' and modify configuration if upgrading cannot be done immediately.\n\n## References\n\n- [GitHub Security Advisory GHSA-cfqr-cjx5-5jcm](https://github.com/andialbrecht/sqlparse/security/advisories/GHSA-cfqr-cjx5-5jcm)\n- [Fix Commit a51df6d9e2d31b44be9adb6bc8732517db6bf96b](https://github.com/andialbrecht/sqlparse/commit/a51df6d9e2d31b44be9adb6bc8732517db6bf96b)\n- [sqlparse 0.6.0 Release Notes](https://github.com/andialbrecht/sqlparse/releases/tag/0.6.0)\n- [CVE.org Record](https://www.cve.org/CVERecord?id=CVE-2026-84305)\n- [NVD Vulnerability Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-84305)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84305) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-02T06:32:30.154542Z"}, {"uuid": "fa6087ad-4b31-4ae3-8e8e-6af18ec3ea51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117201768874255726", "content": "Our CTI team identified a lot of activities targeting gRPC-Go (CVE-2026-84304) https://vuldb.com/vuln/397800/cti", "creation_timestamp": "2026-09-02T13:51:09.484325Z"}, {"uuid": "e8f946a7-608e-404f-9413-0945fd9cc3ce", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "86ecb4e1-bb32-44d5-9f39-8a4673af8385", "vulnerability": "CVE-2026-84308", "type": "published-proof-of-concept", "source": "https://github.com/advisories/GHSA-q97c-8qh3-fpc6", "content": "", "creation_timestamp": "2026-09-08T22:35:07.997438Z"}]}