StackRadar

CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,305
of 17,813 indexed, latest versions
Container images
2,756
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,752
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed4
OSV records
GHSA-vp52-pcj8-j9qcUBUNTU-CVE-2026-84304
Also known as
GO-2026-6348

Charts affected

2,305 by stars
ChartLatestAffected imagesRadar Score
ygdrassil-monitoringygdrassilVerified publisher0.4.02 of 10See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/grafana:11.5.15781759b3d27
google.golang.org/grpc@v1.69.2
1.83.1
quay.io/prometheus/prometheus:v3.1.06559acbd5d77
google.golang.org/grpc@v1.69.0
1.83.1

Open the chart page →

9,526
matrixdb-operatorymatrixOfficialVerified publisher0.13.01 of 2See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
matrixdb/kubebuilder_kube-rbac-proxy:v0.12.0ed3c7e6291e8
google.golang.org/grpc@v1.40.0
1.83.1

Open the chart page →

1,966
rawfile-csiymatrixVerified publisher0.2.14 of 4See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
matrixdb/custom-external-provisioner:4622a07d7-202204247e9ffe249a51
google.golang.org/grpc@v1.40.0
1.83.1
matrixdb/rawfile-csi:v0.2.195b2e38e913d
google.golang.org/grpc@v1.45.0
1.83.1
matrixdb/sig-storage_csi-node-driver-registrar:v2.2.0ba763bb01ddc
google.golang.org/grpc@v1.36.0
1.83.1
matrixdb/sig-storage_livenessprobe:v2.3.07ab06fe3d8a7
google.golang.org/grpc@v1.36.0
1.83.1

Open the chart page →

8,002
prometheus-monitoring-stackyotron-helm-charts1.2.03 of 3See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/grafana:latestf772d434e8fa
google.golang.org/grpc@v1.81.1
1.83.1
quay.io/prometheus/alertmanager:latest690c7b525f43
google.golang.org/grpc@v1.82.1
1.83.1
quay.io/prometheus/prometheus:latest5ce7540c3c00
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

936
zahori-consulzahoriVerified publisher1.0.12 of 2See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/consul:1.15.3ddff34041c5c
google.golang.org/grpc@v1.49.0
1.83.1
hashicorp/consul-k8s-control-plane:1.1.262bed1bf8106
google.golang.org/grpc@v1.49.0
1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/loafoe/mt-mcp-grafana:v0.1.12332d9b47475
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/loafoe/mt-mcp-proxy:v0.1.0221835f9340f
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/loafoe/solgate:v0.0.12b3256cbc7b68
google.golang.org/grpc@v1.56.2
1.83.1
1
ghcr.io/lockdep/stackradar-scanner:0.4.073cbeb990cf4
google.golang.org/grpc@v1.76.0
1.83.1
1
ghcr.io/loft-sh/agent:3.2.45c109914ff73
google.golang.org/grpc@v1.49.0
1.83.1
1
ghcr.io/loft-sh/central-hostpath-mapper:0.2.9fa6dba122171
google.golang.org/grpc@v1.64.0
1.83.1
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
google.golang.org/grpc@v1.50.1
1.83.1
1
ghcr.io/loft-sh/kubernetes:v1.35.090097a08b87c
google.golang.org/grpc@v1.71.1
1.83.1
1
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
google.golang.org/grpc@v1.50.1
1.83.1
1
ghcr.io/loft-sh/vcluster:0.16.484f70425f4dd
google.golang.org/grpc@v1.55.0
1.83.1
1
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
google.golang.org/grpc@v1.50.1
1.83.1
1
ghcr.io/loft-sh/vcluster-hpm:0.2.7f65f6810ea23
google.golang.org/grpc@v1.71.1
1.83.1
1
ghcr.io/loft-sh/vcluster-platform:4.12.19bc88940affc
google.golang.org/grpc@v1.80.0
1.83.1
1
ghcr.io/loft-sh/vnode-runtime:0.3.3b065ec5a5239
google.golang.org/grpc@v1.67.1
1.83.1
1
ghcr.io/loxilb-io/loxilb:latestc7ede1bab641
google.golang.org/grpc@v1.56.3
1.83.1
1
ghcr.io/luisico/cert-manager-webhook-infoblox-wapi:1.5ded797477896
google.golang.org/grpc@v1.29.1
1.83.1
1
ghcr.io/lukaszraczylo/jobs-manager-operator:0.1.15e6239e2838d7
google.golang.org/grpc@v1.78.0
1.83.1
1
ghcr.io/lukaszraczylo/kubernetes-images-sync-operator:0.5.57a424948c8143
google.golang.org/grpc@v1.77.0
1.83.1
1
ghcr.io/luzifer/cert-manager-desec-webhook:v1.0.1fa1f6b2e9a6e
google.golang.org/grpc@v1.64.1
1.83.1
1
ghcr.io/m0nsterrr/cert-manager-webhook-infomaniak:v0.1.5990dbf506d41
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/m9sweeper/trawler:1.6.0df917c5a7e54
google.golang.org/grpc@v1.59.0
1.83.1
1
ghcr.io/manishchaudhary101/kube-argus:latest8e3869d31c70
google.golang.org/grpc@v1.80.0
1.83.1
1
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
google.golang.org/grpc@v1.65.0
1.83.1
1
ghcr.io/marmotdata/marmot:0.10.0bd2a49f86486
google.golang.org/grpc@v1.82.0
1.83.1
1
ghcr.io/media-streaming-mesh/msm-cp:latest8cb08fc7010b
google.golang.org/grpc@v1.66.2
1.83.1
1
ghcr.io/media-streaming-mesh/msm-dp:latest7ffcb25b4cfc
google.golang.org/grpc@v1.66.2
1.83.1
1
ghcr.io/media-streaming-mesh/msm-nc:latest296fe4970e38
google.golang.org/grpc@v1.56.1
1.83.1
1
ghcr.io/melancholictheory/wellcake:0.8.12fd2678f07ef
google.golang.org/grpc@v1.72.2
1.83.1
1
ghcr.io/melodyyangaws/hive-metastore:3.0.0e949b0f733f0
google.golang.org/grpc@v1.22.0
1.83.1
1
ghcr.io/metio/jaas:2026.6.15e28772028e56
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/metrico/gigapipe:v4.1.6caeb2652ce5e
google.golang.org/grpc@v1.81.0
1.83.1
1
ghcr.io/middleware-labs/agent-kube-go:dev17369c4cd390
google.golang.org/grpc@v1.51.0
1.83.1
1
ghcr.io/middleware-labs/mw-kube-agent:master056f0953763d
google.golang.org/grpc@v1.57.0
1.83.1
1
ghcr.io/middleware-labs/mw-kube-agent:1.12.09c7bc0f9bb35
google.golang.org/grpc@v1.67.1
1.83.1
1
ghcr.io/middleware-labs/mw-kube-agent:1.21.0ff23f452813a
google.golang.org/grpc@v1.81.0
1.83.1
1
ghcr.io/middleware-labs/odigos-odiglet:middleware-test-0.0.103c8c835ecee
google.golang.org/grpc@v1.49.0
1.83.1
1
ghcr.io/middleware-labs/vision-odiglet:middleware-test-0.0.3bce34c98668e
google.golang.org/grpc@v1.49.0
1.83.1
1
ghcr.io/mkutlak/alluredeck-api:0.41.0fa429df90c68
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/mohammadv184/cert-manager-webhook-arvancloud:latest179bee5ef8b2
google.golang.org/grpc@v1.54.0
1.83.1
1
ghcr.io/mosn/htnn-controller:v0.3.1c379e66246be
google.golang.org/grpc@v1.63.2
1.83.1
1
ghcr.io/movetokube/postgres-operator:2.4.0def57d85a2da
google.golang.org/grpc@v1.72.1
1.83.1
1
ghcr.io/muhmmadayan/fake-network-operator:0.1.03806b1fd4a4b
google.golang.org/grpc@v1.67.1
1.83.1
1
ghcr.io/mvisonneau/approuvez:v0.1.0441da62e6cb3
google.golang.org/grpc@v1.35.0
1.83.1
1
ghcr.io/mydecisive/octant:0.1.86ebbd44abae6c
google.golang.org/grpc@v1.80.0
1.83.1
1
ghcr.io/nginx/nginx-gateway-fabric:2.4.180f3a0a51af5
google.golang.org/grpc@v1.78.0
1.83.1
1
ghcr.io/nginx/nginx-gateway-fabric:2.6.6c10f734589e9
google.golang.org/grpc@v1.81.1
1.83.1
1
ghcr.io/nicholaswilde/olivetin:version-2021-07-19e1d5c8a01008
google.golang.org/grpc@v1.37.0
1.83.1
1
ghcr.io/niklas-letz/cert-manager-webhook-solidserver:1.0.2f19a306ce759
google.golang.org/grpc@v1.79.3
1.83.1
1
ghcr.io/nnstd/glauth:2.52e6e09fa77dd
google.golang.org/grpc@v1.73.0
1.83.1
1
ghcr.io/nnstd/seaweedfs-operator:1.43ebe2fd253f6
google.golang.org/grpc@v1.73.0
1.83.1
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.