CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,311; of 17,832 indexed, latest versions
Container images: 2,758; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,311 of 17,832 indexed charts deploy, on 2,758 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,754
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-vp52-pcj8-j9qc UBUNTU-CVE-2026-84304
Also known as: GO-2026-6348

Charts affected

2,311 by stars

Chart

Latest

Affected images

Radar Score

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

13,629

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,928

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,821

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,530

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,003

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,758 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
grafana/grafana :12.0.2	b5b59bfc7561	google.golang.org/grpc@v1.72.1	1.83.1	1
grafana/grafana :8.1.5	b7dd9cd0e59d	google.golang.org/grpc@v1.39.0	1.83.1	1
grafana/grafana :12.3.2	ba93c9d192e5	google.golang.org/grpc@v1.77.0	1.83.1	1
grafana/grafana :6.5.1	befcd84da2c1	google.golang.org/grpc@v1.23.1	1.83.1	1
grafana/grafana :8.3.5	cd7cb4345aa7	google.golang.org/grpc@v1.41.0	1.83.1	1
grafana/grafana :8.3.4	cf81d2c753c8	google.golang.org/grpc@v1.41.0	1.83.1	1
grafana/grafana :7.4.5	d322192ed2fa	google.golang.org/grpc@v1.35.0	1.83.1	1
grafana/grafana :9.3.6	e5a9655dabef	google.golang.org/grpc@v1.45.0	1.83.1	1
grafana/grafana :8.5.3	ecc1b80b8ca2	google.golang.org/grpc@v1.42.0	1.83.1	1
grafana/grafana :10.4.0	f9811e4e687f	google.golang.org/grpc@v1.60.1	1.83.1	1
grafana/grafana :11.3.1	fa801ab6e1ae	google.golang.org/grpc@v1.66.0	1.83.1	1
grafana/logcli :main-c90366d-amd64	3d85bb66e39b	google.golang.org/grpc@v1.37.0	1.83.1	1
grafana/loki :2.9.10	35b02acc6765	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki :2.9.2	6074e01dbe03	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki :2.9.6	6ca6e2cd3b6f	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki :3.0.0	757b5fadf816	google.golang.org/grpc@v1.62.1	1.83.1	1
grafana/loki :2.0.0	77e138f81a8e	google.golang.org/grpc@v1.29.1	1.83.1	1
grafana/loki :3.7.4	87f0a0676737	google.golang.org/grpc@v1.81.1	1.83.1	1
grafana/loki :3.2.0	882e30c20683	google.golang.org/grpc@v1.65.0	1.83.1	1
grafana/loki :3.3.2	8af2de1abbdd	google.golang.org/grpc@v1.67.1	1.83.1	1
grafana/loki :3.6.1	92bd5700577b	google.golang.org/grpc@v1.75.1	1.83.1	1
grafana/loki :2.8.2	b1da1d23037e	google.golang.org/grpc@v1.52.3	1.83.1	1
grafana/loki :2.4.2	b3af8ead67d7	google.golang.org/grpc@v1.40.0	1.83.1	1
grafana/loki :3.6.3	cd6e176883a9	google.golang.org/grpc@v1.75.1	1.83.1	1
grafana/loki :3.7.7 :latest	d70e4659623f	google.golang.org/grpc@v1.82.1	1.83.1	1
grafana/loki :3.7.6	efd47c67f9ba	google.golang.org/grpc@v1.82.1	1.83.1	1
grafana/loki-canary :3.6.12	1e9bfcff3867	google.golang.org/grpc@v1.81.1	1.83.1	1
grafana/loki-canary :3.0.0	28d7c00588aa	google.golang.org/grpc@v1.62.1	1.83.1	1
grafana/loki-canary :3.1.0	39baf6d67f85	google.golang.org/grpc@v1.62.1	1.83.1	1
grafana/loki-canary :2.9.2	4249db29b992	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki-canary :3.2.0	49e03f80d361	google.golang.org/grpc@v1.65.0	1.83.1	1
grafana/loki-canary :2.9.6	549a40203e97	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/loki-canary :2.6.1	ab2a2569307b	google.golang.org/grpc@v1.44.0	1.83.1	1
grafana/loki-canary :3.6.5	fbb984bab741	google.golang.org/grpc@v1.75.1	1.83.1	1
grafana/mcp-grafana :1.5.1	07c6614a8f8b	google.golang.org/grpc@v1.80.0	1.83.1	1
grafana/mcp-grafana :0.14.0	42f541f22063	google.golang.org/grpc@v1.80.0	1.83.1	1
grafana/mimir :r292-5f01872	7476e456c738	google.golang.org/grpc@v1.63.2	1.83.1	1
grafana/mimir :2.0.0	80c1a8eb24dd	google.golang.org/grpc@v1.41.1	1.83.1	1
grafana/mimir :2.15.0	85f55510e0d3	google.golang.org/grpc@v1.65.0	1.83.1	1
grafana/otel-lgtm :0.11.10	09d8c3ce4f3a	google.golang.org/grpc@v1.75.0	1.83.1	1
grafana/phlare :0.5.1	330f990cdad9	google.golang.org/grpc@v1.44.0	1.83.1	1
grafana/promtail :2.6.1	072527b12cdf	google.golang.org/grpc@v1.44.0	1.83.1	1
grafana/promtail :2.0.0	5fd12edcc694	google.golang.org/grpc@v1.29.1	1.83.1	1
grafana/promtail :2.9.10	63a2e57a5b14	google.golang.org/grpc@v1.56.3	1.83.1	1
grafana/promtail :3.5.1	65bfae480b57	google.golang.org/grpc@v1.71.0	1.83.1	1
grafana/promtail :3.6.1	8dcfdf466da0	google.golang.org/grpc@v1.75.1	1.83.1	1
grafana/promtail :2.7.0	c16c710f7333	google.golang.org/grpc@v1.45.0	1.83.1	1
grafana/pyroscope :1.10.0	319bf32ae06b	google.golang.org/grpc@v1.62.1	1.83.1	1
grafana/pyroscope :2.0.3	cfd00e7f73c2	google.golang.org/grpc@v1.80.0	1.83.1	1
grafana/rollout-operator :v0.38.1	32fe838b79dd	google.golang.org/grpc@v1.82.0	1.83.1	1