CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,305; of 17,813 indexed, latest versions
Container images: 2,756; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,752
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-vp52-pcj8-j9qc UBUNTU-CVE-2026-84304
Also known as: GO-2026-6348

Charts affected

2,305 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/o0th/cert-manager-webhook-bunny :1.0.2	fe7ce555a12d	google.golang.org/grpc@v1.69.4	1.83.1	1
ghcr.io/oguzhan-yilmaz/argocd-backup-s3 :latest	b61c750ade19	google.golang.org/grpc@v1.15.0	1.83.1	1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots :0.0.203	5bc5ca66d55a	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots :0.0.55	d7f93d2182fe	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--powerpipe :latest	a16ab5ca10a7	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/oguzhan-yilmaz/steampipe-powerpipe-kubernetes--steampipe :latest	c0c8d53df9f3	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/okteto/backend :0.0.0-2026-08-17	629bdce31b4d	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/okteto/buildkit :0.0.0-2026-08-03 :0.0.0-2026-08-17	14527ca5d2a9	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/okteto/okteto :3.22.0	4585017f52f6	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/okteto/registry :0.0.0-2026-08-17	69131511501f	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/olivetin/olivetin :2025.2.19	a89958921526	google.golang.org/grpc@v1.69.2	1.83.1	1
ghcr.io/openclarity/grype-server :v0.6.0	79412399f301	google.golang.org/grpc@v1.55.0	1.83.1	1
ghcr.io/openclarity/kubeclarity :v2.23.3	14450f52a708	google.golang.org/grpc@v1.56.3	1.83.1	1
ghcr.io/openclarity/kubeclarity-sbom-db :v2.23.3	cef2b88bfc76	google.golang.org/grpc@v1.56.3	1.83.1	1
ghcr.io/openconfig/gnmic :0.45.0	d422a9ebd4a2	google.golang.org/grpc@v1.78.0	1.83.1	1
ghcr.io/openfaasltd/gcp-pubsub-connector :0.0.1	8df071f5b719	google.golang.org/grpc@v1.71.0	1.83.1	1
ghcr.io/openfaasltd/headroom-controller :v0.0.4	67d587cc2c39	google.golang.org/grpc@v1.68.1	1.83.1	1
ghcr.io/openfaasltd/pro-builder :0.6.0	6c17297f9098	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/open-feature/flagd :v0.16.0	32234e63c1d0	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/open-feature/flagd :v0.11.1	a7ea52f87446	google.golang.org/grpc@v1.65.0	1.83.1	1
ghcr.io/open-feature/open-feature-operator :v0.9.3	b37a442c0497	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/openlit/openlit :1.24.0	2434560e8f0e	google.golang.org/grpc@v1.77.0	1.83.1	1
ghcr.io/openlit/openlit-controller :0.10.0	165efd4469ea	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/openlit/openlit-operator :0.0.2	457bb5ada68b	google.golang.org/grpc@v1.68.1	1.83.1	1
ghcr.io/openrelik/openrelik-worker-containers :latest	a6d5abe94706	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/open-telemetry/demo :1.12.0-productcatalogservice	008b9b662289	google.golang.org/grpc@v1.64.0	1.83.1	1
ghcr.io/open-telemetry/demo :1.12.0-checkoutservice	380eccdc29e9	google.golang.org/grpc@v1.64.0	1.83.1	1
ghcr.io/open-telemetry/demo :1.12.0-shippingservice	a3ca4c02a5df	google.golang.org/grpc@v1.60.1	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-ebpf-instrumentation/ebpf-instrument :v0.9.0	26f82b148dfe	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.148.0	590e50477b76	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.132.0	5e331c925091	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.144.0	79b81912f1fb	google.golang.org/grpc@v1.77.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.150.0	89490ef63b72	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/opentelemetry-operator :0.158.0	d4789a6537fd	google.golang.org/grpc@v1.83.0	1.83.1	1
ghcr.io/open-telemetry/opentelemetry-operator/target-allocator :0.124.0	8936271cf56a	google.golang.org/grpc@v1.71.0	1.83.1	1
ghcr.io/opnpulse/tenant-operator :v0.0.2	787f6de2b620	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/opnpulse/thanos-operator :v2026.4.24	e05a3e701291	google.golang.org/grpc@v1.76.0	1.83.1	1
ghcr.io/orkspace/orkestra :0.7.17	38c388cfc8d1	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/ownkube/kubernetes-events-exporter :0.1.2	bcb7f0f733f5	google.golang.org/grpc@v1.80.0	1.83.1	1
ghcr.io/oxidecomputer/cluster-api-provider-oxide :0.2.3	7b05d3bbfbfa	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/parca-dev/parca :v0.24.2	3776500fde82	google.golang.org/grpc@v1.75.0	1.83.1	1
ghcr.io/parca-dev/parca-agent :v0.28.0	6d6794f45f3e	google.golang.org/grpc@v1.59.0	1.83.1	1
ghcr.io/parca-dev/parca-agent :v0.42.0	adc0eeb4dd05	google.golang.org/grpc@v1.74.2	1.83.1	1
ghcr.io/parmincloud/arvancloud-certmanager-issuer :v1.0.0	0b97452674a3	google.golang.org/grpc@v1.75.1	1.83.1	1
ghcr.io/pbufio/registry :v0.4.1	77a36c035b4b	google.golang.org/grpc@v1.76.0	1.83.1	1
ghcr.io/peak-scale/capsule-argo-addon :0.7.5	087a80163971	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/peak-scale/observability-tenancy/loki-proxy :0.4.1	548e962d0061	google.golang.org/grpc@v1.73.0	1.83.1	1
ghcr.io/peak-scale/sops-operator :0.10.1	1da9b716b792	google.golang.org/grpc@v1.82.0	1.83.1	1
ghcr.io/performancecopilot/archive-analysis :latest	8de11e2363fc	google.golang.org/grpc@v1.66.0	1.83.1	1
ghcr.io/permify/permify :v1.3.5	f0c6f7d7daa6	google.golang.org/grpc@v1.64.0	1.83.1	1