CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,275; of 17,813 indexed, latest versions
Container images: 2,703; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,275 of 17,813 indexed charts deploy, on 2,703 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,700
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	3

OSV records: GHSA-vp52-pcj8-j9qc UBUNTU-CVE-2026-84304
Also known as: GO-2026-6348

Charts affected

2,275 by stars

Chart

Latest

Affected images

Radar Score

victoria-metrics-k8s-stackwenerme

0.92.1

3 of 7 See more

victoria-metrics-k8s-stack wenerme 0.92.1

3 of the 7 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :13.1.1	7cb8c64c4d57	google.golang.org/grpc@v1.81.1	1.83.1
victoriametrics/operator :v0.74.1	7310c4a80b94	google.golang.org/grpc@v1.82.1	1.83.1
registry.k8s.io/kube-state-metrics/kube-state-metrics :v2.19.1	85108987d044	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

1,954

victoria-metrics-operatorwenerme

0.67.3

1 of 1 See more

victoria-metrics-operator wenerme 0.67.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
victoriametrics/operator :v0.74.1	7310c4a80b94	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

125

wexa-studiowexa-studio

1.2.0

5 of 15 See more

wexa-studio wexa-studio 1.2.0

5 of the 15 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
hashicorp/vault :1.15.4	0b01ed3924e6	google.golang.org/grpc@v1.58.3	1.83.1
minio/minio :RELEASE.2024-01-16T16-07-38Z	4c4a4876193f	google.golang.org/grpc@v1.60.1	1.83.1
temporalio/admin-tools :1.29.1-tctl-1.18.4-cli-1.5.0	a3a52e6ca122	google.golang.org/grpc@v1.56.3	1.83.1
temporalio/server :1.29.1	c1e3326b2ce1	google.golang.org/grpc@v1.72.2	1.83.1
temporalio/ui :2.44.0	0b36e00aad30	google.golang.org/grpc@v1.66.1	1.83.1

Open the chart page →

15,387

ceph-csi-cephfswikimedia

0.1.8

5 of 5 See more

ceph-csi-cephfs wikimedia 0.1.8

5 of the 5 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
gcr.io/k8s-staging-sig-storage/csi-provisioner :v3.2.1	4ad5fcdbe7e9	google.golang.org/grpc@v1.45.0	1.83.1
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	google.golang.org/grpc@v1.48.0	1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.5.1	0103eee7c35e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-resizer :v1.5.0	8f7520bd957e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-snapshotter :v6.0.1	ad16874e2140	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

10,334

ceph-csi-rbdwikimedia

0.1.13

6 of 6 See more

ceph-csi-rbd wikimedia 0.1.13

6 of the 6 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
gcr.io/k8s-staging-sig-storage/csi-provisioner :v3.2.1	4ad5fcdbe7e9	google.golang.org/grpc@v1.45.0	1.83.1
quay.io/cephcsi/cephcsi :v3.7.2	f7f8228f17cc	google.golang.org/grpc@v1.48.0	1.83.1
registry.k8s.io/sig-storage/csi-attacher :v3.5.0	dd245051317e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.5.1	0103eee7c35e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-resizer :v1.5.0	8f7520bd957e	google.golang.org/grpc@v1.40.0	1.83.1
registry.k8s.io/sig-storage/csi-snapshotter :v6.0.1	ad16874e2140	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

11,840

jaegerwikimedia

3.1.2

3 of 4 See more

jaeger wikimedia 3.1.2

3 of the 4 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
jaegertracing/jaeger-agent :1.53.0	0214a0ef24b1	google.golang.org/grpc@v1.60.0	1.83.1
jaegertracing/jaeger-collector :1.53.0	7f1269222903	google.golang.org/grpc@v1.60.0	1.83.1
jaegertracing/jaeger-query :1.53.0	049bb0d64ea3	google.golang.org/grpc@v1.60.0	1.83.1

Open the chart page →

9,365

opentelemetry-collectorwikimedia

0.62.7

1 of 1 See more

opentelemetry-collector wikimedia 0.62.7

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
otel/opentelemetry-collector-contrib :0.81.0	c6671841470b	google.golang.org/grpc@v1.56.1	1.83.1

Open the chart page →

2,035

wireguardwireguard-bananas

1.5.0

1 of 1 See more

wireguard wireguard-bananas 1.5.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
place1/wg-access-server :v0.4.6	2b2f3ea80ed6	google.golang.org/grpc@v1.30.0	1.83.1

Open the chart page →

2,753

csi-driver-host-pathwiremind

0.1.1

8 of 8 See more

csi-driver-host-path wiremind 0.1.1

8 of the 8 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
registry.k8s.io/sig-storage/csi-attacher :v4.0.0	9a685020911e	google.golang.org/grpc@v1.47.0	1.83.1
registry.k8s.io/sig-storage/csi-external-health-monitor-controller :v0.7.0	80b9ba94aa2a	google.golang.org/grpc@v1.48.0	1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar :v2.6.0	f1c25991bac2	google.golang.org/grpc@v1.50.1	1.83.1
registry.k8s.io/sig-storage/csi-provisioner :v3.3.0	ee3b525d5b89	google.golang.org/grpc@v1.49.0	1.83.1
registry.k8s.io/sig-storage/csi-resizer :v1.6.0	425d8f1b7693	google.golang.org/grpc@v1.47.0	1.83.1
registry.k8s.io/sig-storage/csi-snapshotter :v6.1.0	291334908ddf	google.golang.org/grpc@v1.47.0	1.83.1
registry.k8s.io/sig-storage/hostpathplugin :v1.9.0	92257881c1d6	google.golang.org/grpc@v1.34.0	1.83.1
registry.k8s.io/sig-storage/livenessprobe :v2.8.0	cacee2b5c36d	google.golang.org/grpc@v1.48.0	1.83.1

Open the chart page →

12,666

orcwiremind

0.3.0

1 of 1 See more

orc wiremind 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
quay.io/orc/openstack-resource-controller :v2.5.0	79f22af49612	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

277

registrywiremind

0.1.1

1 of 1 See more

registry wiremind 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
ghcr.io/distribution/distribution :3.0.0	4ba3adf47f5c	google.golang.org/grpc@v1.68.0	1.83.1

Open the chart page →

1,358

kafka-connect-uiwitcom-gmbh

0.5.0

1 of 2 See more

kafka-connect-ui witcom-gmbh 0.5.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.3.0	8c21390be87d	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

2,513

mrtg-backendwitcom-gmbh

0.7.0

1 of 2 See more

mrtg-backend witcom-gmbh 0.7.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
quay.io/oauth2-proxy/oauth2-proxy :v7.2.1	febeebebe762	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

2,624

xboardxboard

0.2.0

1 of 1 See more

xboard xboard 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
ghcr.io/cedar2025/xboard :latest	896e4926e0d7	google.golang.org/grpc@v1.81.0	1.83.1

Open the chart page →

1,060

xkopsxkops

0.1.0

1 of 5 See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
murtazashah46/helmfile :latest	4d11726cf803	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

13,895

xonodepoolsxonodepools

1.0.7

1 of 1 See more

xonodepools xonodepools 1.0.7

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
xosphere/xonodepools :1.0.7	1458097b6f85	google.golang.org/grpc@v1.72.2	1.83.1

Open the chart page →

402

atlas-operatorxxl-job-admin

0.7.11

1 of 1 See more

atlas-operator xxl-job-admin 0.7.11

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
arigaio/atlas-operator :0.7.11	1c4caa13c92b	google.golang.org/grpc@v1.73.0	1.83.1

Open the chart page →

1,197

fleet-managementxxl-job-admin

1.0.0

1 of 1 See more

fleet-management xxl-job-admin 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
ghcr.io/dellnoantechnp/alloy-remote-config/fleet-management :master	4371b566d238	google.golang.org/grpc@v1.79.3	1.83.1

Open the chart page →

238

kadalu-operatorxxl-job-admin

1.2.4

1 of 4 See more

kadalu-operator xxl-job-admin 1.2.4

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
raspbernetes/csi-node-driver-registrar :2.0.1	a552705225fd	google.golang.org/grpc@v1.27.0	1.83.1

Open the chart page →

4,926

nightingalexxl-job-admin

0.2.11

2 of 6 See more

nightingale xxl-job-admin 0.2.11

2 of the 6 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
flashcatcloud/categraf :latest	42e6ab16472e	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :v2.54.1	f6639335d34a	google.golang.org/grpc@v1.65.0	1.83.1

Open the chart page →

9,730

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,518

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,703 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
ghcr.io/telepresenceio/tel2 :2.31.2	6f1d705594ba	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/terminus-io/enforcer :v1.1.0	f21b905610d6	google.golang.org/grpc@v1.78.0	1.83.1	1
ghcr.io/tjm/vault-gcp-secrets :v1.19.5	9f157fe035f1	google.golang.org/grpc@v1.70.0	1.83.1	1
ghcr.io/topolvm/topolvm-with-sidecar :0.41.1	70548dbe0c6a	google.golang.org/grpc@v1.78.0	1.83.1	1
ghcr.io/topolvm/topolvm-with-sidecar :0.35.0	b354978c440d	google.golang.org/grpc@v1.64.0	1.83.1	1
ghcr.io/traefik/hub-manager :v0.45.1	d1cff2560c67	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/traefik/traefik-hub :v2.11.0	322f5f8cc105	google.golang.org/grpc@v1.58.3	1.83.1	1
ghcr.io/transparency-dev/tesseract/posix :v0.1.2	b044edd23888	google.golang.org/grpc@v1.82.0	1.83.1	1
ghcr.io/turbot/guardrails-agent-kubernetes :0.3.0	9d01bf9c9224	google.golang.org/grpc@v1.65.0	1.83.1	1
ghcr.io/twigex/cospace :latest	e5ecfd607e42	google.golang.org/grpc@v1.62.0	1.83.1	1
ghcr.io/upbothq/upbot-operator :v0.0.20	e5da24947c91	google.golang.org/grpc@v1.68.1	1.83.1	1
ghcr.io/upcloudltd/upcloud-csi	5af91c663788	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/usememos/memos :0.24.0	4723d86e6797	google.golang.org/grpc@v1.69.2	1.83.1	1
ghcr.io/v6d-io/v6d/kube-rbac-proxy :v0.13.0	a2523c532c0c	google.golang.org/grpc@v1.40.0	1.83.1	1
ghcr.io/valkey-io/valkey-operator :v0.6.0	52a0f1ed0c03	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/vedooo/reactive-policy :0.4.1	d92eda891c91	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/voidmind-io/voidllm :0.0.25	0df11dd20c28	google.golang.org/grpc@v1.82.1	1.83.1	1
ghcr.io/vojtechpastyrik/muthur :0.10.0	b5a06a6e13b9	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/vojtechpastyrik/muthur-collector :0.11.0	0a580fe3a032	google.golang.org/grpc@v1.81.1	1.83.1	1
ghcr.io/voyagermesh/crd-manager :v0.1.0	13fd0cccafe8	google.golang.org/grpc@v1.75.1	1.83.1	1
ghcr.io/voyagermesh/gateway :v1.6.2	23f4da194134	google.golang.org/grpc@v1.76.0	1.83.1	1
ghcr.io/voyagermesh/gateway :v0.0.1	a8a144f14889	google.golang.org/grpc@v1.54.0	1.83.1	1
ghcr.io/voyagermesh/gateway-converter :v0.0.1	b92123805584	google.golang.org/grpc@v1.63.2	1.83.1	1
ghcr.io/voyagermesh/voyager :v17.5.0	4964ceaf9d35	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/warpstreamlabs/bento :1.8.1	21715979aefa	google.golang.org/grpc@v1.70.0	1.83.1	1
ghcr.io/wasilak/go-hello-world :1.8.3	66d353e7693f	google.golang.org/grpc@v1.77.0	1.83.1	1
ghcr.io/wundergraph/cosmo/otelcollector :0.18.1	5a6fe78d4d15	google.golang.org/grpc@v1.64.0	1.83.1	1
ghcr.io/wundergraph/cosmo/router :0.243.0	5afcab98d9d7	google.golang.org/grpc@v1.68.1	1.83.1	1
ghcr.io/xmv-solutions-gmbh/cert-manager-webhook-hcloud-zones :0.1.5	a7a846bba3e8	google.golang.org/grpc@v1.79.3	1.83.1	1
ghcr.io/ydixken/pgcopydb-operator :v0.13.3	06096c6ec357	google.golang.org/grpc@v1.82.2	1.83.1	1
ghcr.io/zapier/kubechecks :latest	60cea46ce830	google.golang.org/grpc@v1.83.0	1.83.1	1
ghcr.io/zeiss/typhoon/controller :0.2.3	4fdf4edfda45	google.golang.org/grpc@v1.70.0	1.83.1	1
ghcr.io/zeiss/typhoon/typhoon-webhook :0.2.3	78f9b82050bc	google.golang.org/grpc@v1.70.0	1.83.1	1
ghcr.io/zufardhiyaulhaq/frp-operator :v0.11.0	cd25ee354df2	google.golang.org/grpc@v1.58.3	1.83.1	1
mcr.microsoft.com/acstor/local-csi-driver :v0.3.0	f9af53a79fd1	google.golang.org/grpc@v1.83.0	1.83.1	1
mcr.microsoft.com/acstor/local-csi-manager :v0.3.0	4f464b52ba85	google.golang.org/grpc@v1.83.0	1.83.1	1
mcr.microsoft.com/aks/kaito/gpu-provisioner :0.2.0	1204a7e948e9	google.golang.org/grpc@v1.56.3	1.83.1	1
mcr.microsoft.com/aks/kaito/ragengine :0.12.0	7bfe651c92db	google.golang.org/grpc@v1.82.1	1.83.1	1
mcr.microsoft.com/aks/kaito/workspace :0.12.0	c4b887ca0542	google.golang.org/grpc@v1.82.1	1.83.1	1
mcr.microsoft.com/application-lb/images/alb-controller :1.12.1	72f33b24bc67	google.golang.org/grpc@v1.82.1	1.83.1	1
mcr.microsoft.com/application-lb/images/alb-controller-bootstrap :1.12.1	cc129fd1c904	google.golang.org/grpc@v1.82.1	1.83.1	1
mcr.microsoft.com/k8s/csi/azuredisk-csi :v1.1.1	ec1803037ed9	google.golang.org/grpc@v1.27.0	1.83.1	1
mcr.microsoft.com/oss/kubernetes-csi/csi-attacher :v2.2.0	f55f30876129	google.golang.org/grpc@v1.26.0	1.83.1	1
mcr.microsoft.com/oss/kubernetes-csi/csi-node-driver-registrar :v2.0.1	fc5d14e9f26f	google.golang.org/grpc@v1.27.0	1.83.1	1
mcr.microsoft.com/oss/kubernetes-csi/csi-provisioner :v1.6.1	667b1b1ea1e4	google.golang.org/grpc@v1.26.0	1.83.1	1
mcr.microsoft.com/oss/kubernetes-csi/csi-resizer :v1.1.0	7997e0f236bc	google.golang.org/grpc@v1.34.0	1.83.1	1
mcr.microsoft.com/oss/kubernetes-csi/livenessprobe :v2.2.0	b7d82802cca8	google.golang.org/grpc@v1.34.0	1.83.1	1
mcr.microsoft.com/oss/v2/kubernetes-csi/azurefile-csi :v1.35.7	6e43ba0bd009	google.golang.org/grpc@v1.82.0	1.83.1	1
mcr.microsoft.com/oss/v2/kubernetes-csi/blob-csi :v1.27.9	f9e20264150a	google.golang.org/grpc@v1.82.0	1.83.1	1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-node-driver-registrar :v2.14.0	6cb172e3de7e	google.golang.org/grpc@v1.72.1	1.83.1	1