{"id":"GO-2026-6348","summary":"Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc","details":"Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation in google.golang.org/grpc","aliases":["CVE-2026-84304","GHSA-vp52-pcj8-j9qc"],"modified":"2026-09-15T19:00:16.944663241Z","published":"2026-09-15T18:39:25Z","database_specific":{"review_status":"REVIEWED","url":"https://pkg.go.dev/vuln/GO-2026-6348"},"references":[{"type":"ADVISORY","url":"https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc"},{"type":"FIX","url":"https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176"},{"type":"WEB","url":"https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77"},{"type":"WEB","url":"https://github.com/grpc/grpc-go/pull/9331"},{"type":"WEB","url":"https://github.com/grpc/grpc-go/pull/9333"},{"type":"WEB","url":"https://github.com/grpc/grpc-go/releases/tag/v1.83.1"}],"affected":[{"package":{"name":"google.golang.org/grpc","ecosystem":"Go","purl":"pkg:golang/google.golang.org/grpc"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.83.1"}]}],"ecosystem_specific":{"imports":[{"path":"google.golang.org/grpc/internal/transport","symbols":["ClientStream.Close","ClientStream.Header","ClientStream.Read","ClientStream.RecvCompress","ClientStream.TrailersOnly","NewHTTP2Client","NewServerTransport","ServerStream.Read","Stream.ReadMessageHeader","http2Client.Close","http2Client.GracefulClose","http2Client.NewStream","http2Client.newStream","http2Server.Close","http2Server.HandleStreams","http2Server.operateHeaders","recvBuffer.init","recvBuffer.load","recvBuffer.put","recvBufferReader.Read","recvBufferReader.ReadMessageHeader","serverHandlerTransport.HandleStreams","transportReader.Read","transportReader.ReadMessageHeader"]},{"path":"google.golang.org/grpc/mem","symbols":["BufferSlice.MaterializeToBuffer","Copy","IsBelowBufferPoolingThreshold","NewBuffer","ReadAll","writer.Write"]}]},"database_specific":{"source":"https://vuln.go.dev/ID/GO-2026-6348.json"}}],"schema_version":"1.9.0"}