CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,305; of 17,813 indexed, latest versions
Container images: 2,756; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,752
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-vp52-pcj8-j9qc UBUNTU-CVE-2026-84304
Also known as: GO-2026-6348

Charts affected

2,305 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	2ef460356b17	google.golang.org/grpc@v1.28.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.13.1	34796e9f760b	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler :v1.10.2	8319aa662b49	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler	db6ceff2aab4	google.golang.org/grpc@v1.33.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscaler-hpa :v1.10.2	eb612b929eaa	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	30ce73388ae5	google.golang.org/grpc@v1.28.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.13.1	53d9aa4d2c7a	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.2.5	75cfdcfa050a	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller :v1.10.2	98a2cc7fd62e	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	b2cd45b8a8a4	google.golang.org/grpc@v1.33.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/controller	bac158dfb0c7	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping :v1.2.5	23baa1932232	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping	e384a295069b	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping :v1.10.2	f66c41ad7a73	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping-webhook	15f1ce7f35b4	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping-webhook :v1.10.2	7368aaddf2be	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/domain-mapping-webhook :v1.2.5	847bb97e3844	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/webhook	1282a399cbb9	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/webhook :v1.10.2	4305209ce498	google.golang.org/grpc@v1.48.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/webhook :v1.13.1	700c69915dc7	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/webhook :v1.2.5	9084ea8498ea	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/webhook	d27b4495ccc3	google.golang.org/grpc@v1.33.1	1.83.1	1
gcr.io/knative-releases/knative.dev/serving/cmd/webhook	f16c0e022203	google.golang.org/grpc@v1.28.1	1.83.1	1
gcr.io/kubecost1/cost-model :prod-2.5.5	02b90651367f	google.golang.org/grpc@v1.67.1	1.83.1	1
gcr.io/kubecost1/cost-model :prod-1.81.0	67f4f162da8d	google.golang.org/grpc@v1.27.1	1.83.1	1
gcr.io/kubecost1/cost-model :prod-1.108.1	852f7923fad3	google.golang.org/grpc@v1.59.0	1.83.1	1
gcr.io/kubecost1/cost-model :prod-1.82.2	989a60847416	google.golang.org/grpc@v1.27.1	1.83.1	1
gcr.io/kubecost1/cost-model :prod-2.6.3	9e507ac0aebb	google.golang.org/grpc@v1.69.4	1.83.1	1
gcr.io/kubecost1/server :prod-1.82.2	2b1a3d08caac	google.golang.org/grpc@v1.19.1	1.83.1	1
gcr.io/kubecost1/server :prod-1.81.0	a348db3e4d74	google.golang.org/grpc@v1.19.1	1.83.1	1
gcr.io/ml-pipeline/api-server :2.3.0	39661bd823e8	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/ml-pipeline/api-server :2.0.0-alpha.5	dc6ca05bb94f	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/ml-pipeline/cache-server :2.3.0	293941ee4f65	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/ml-pipeline/cache-server :2.0.0-alpha.5	83e79c709df3	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/ml-pipeline/persistenceagent :2.0.0-alpha.5	00db9796a37b	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/ml-pipeline/persistenceagent :2.3.0	109ac1b38c41	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/ml-pipeline/scheduledworkflow :2.0.0-alpha.5	795a0c8a0e13	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/ml-pipeline/scheduledworkflow :2.3.0	f7e67e0bc071	google.golang.org/grpc@v1.60.1	1.83.1	1
gcr.io/ml-pipeline/workflow-controller :v3.3.8-license-compliance	6c8e4e2a6443	google.golang.org/grpc@v1.44.0	1.83.1	1
gcr.io/press-labs-public/dashboard :1.8.19	b88f88070fb0	google.golang.org/grpc@v1.55.0	1.83.1	1
gcr.io/projectsigstore/cosigned	784518ff3ee7	google.golang.org/grpc@v1.46.0	1.83.1	1
gcr.io/projectsigstore/policy-webhook	82940e8c3e0d	google.golang.org/grpc@v1.46.0	1.83.1	1
ghcr.io/absmach/magistrala/ui-backend :latest	4adf360dbf1e	google.golang.org/grpc@v1.83.0	1.83.1	1
ghcr.io/adfinis/kubernetes-etcd-backup :v1.4.6	8ec6c4812a7e	google.golang.org/grpc@v1.59.0	1.83.1	1
ghcr.io/alpineworks/ip :v1.0.0	4e0d4d51f0bc	google.golang.org/grpc@v1.70.0	1.83.1	1
ghcr.io/alpineworks/katalog-agent :v1.0.4	8f50bd568c2b	google.golang.org/grpc@v1.68.0	1.83.1	1
ghcr.io/alpineworks/katalog-backend :v1.0.7	7e7a26393cd1	google.golang.org/grpc@v1.68.0	1.83.1	1
ghcr.io/alpineworks/katalog-migrations :v1.0.5	62c44a384e13	google.golang.org/grpc@v1.64.1	1.83.1	1
ghcr.io/alpineworks/versitygw-webhook-pulsar-proxy :v1.0.0	6e9ced773732	google.golang.org/grpc@v1.71.0	1.83.1	1
ghcr.io/analogj/scrutiny :master-omnibus	18689773150d	google.golang.org/grpc@v1.44.0	1.83.1	1