gRPC-Go CVE-2026-84304

No special configuration is required - the vulnerability is triggered by normal HTTP/2 framing behavior in any gRPC-Go server or client prior to 1.83.1 that accepts connections. The CVSS PR:N vector confirms no authentication is needed. The service must be network-reachable (typically on a configured gRPC TCP port). The primary limiting factor is practical: the attacker must sustain a high-volume fragmented DATA frame flood across multiple concurrent streams long enough to exhaust available memory; this may be slowed but not prevented by network bandwidth constraints, connection rate limits, or server-side MaxConcurrentStreams configuration. Services with large memory allocations will take longer to crash but remain fully vulnerable.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VA:H) accurately reflects the attack surface: network-accessible, low complexity, no authentication, high availability impact. Any internet-exposed or cluster-internal gRPC-Go service is inherently reachable, and the attack requires only a standard HTTP/2 or gRPC client capable of stream multiplexing and fine-grained frame control. Even a mid-sized municipal IT team in bytom operating Go-based microservices on Kubernetes should treat this as urgent if any gRPC-Go service accepts connections from untrusted clients. No EPSS score was supplied in the input data, but the low exploitation complexity and broad deployment footprint of gRPC-Go in cloud-native Go services suggest material real-world risk. CISA KEV status is not confirmed and no public PoC has been identified at time of analysis; however, the technique is straightforward and fully described in the public security advisory. The sole practical limiting factor is the attacker's ability to sustain a high-volume fragmented stream long enough to exhaust server memory.

An attacker establishes one or more gRPC connections to a target service and opens multiple concurrent HTTP/2 streams, sending valid but heavily fragmented DATA frames with each stream carrying millions of one-byte payloads. Because HTTP/2 flow-control only tracks payload bytes and not the number of recvMsg allocations, the server accumulates millions of heap objects per stream and exhausts available process memory. No public exploit code has been identified, but the technique is straightforward and directly described in the public GitHub advisory and the PR diff.