CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026

Severity: High; worst across findings
CVSS: 8.7; base score, highest
EPSS: 0.004; 35th percentile
CISA KEV: Not listed; no confirmed exploitation
Charts affected: 2,305; of 17,813 indexed, latest versions
Container images: 2,756; deployed by those charts
Fix available: 1 of 2; affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected package	Affected versions	Fixed in	Images
google.golang.org/grpcgolang	v0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more	1.83.1	2,752
grpcdeb	1.16.1-1ubuntu5, 1.51.1-4.1build5	no fix listed	4

OSV records: GHSA-vp52-pcj8-j9qc UBUNTU-CVE-2026-84304
Also known as: GO-2026-6348

Charts affected

2,305 by stars

Chart

Latest

Affected images

Radar Score

ygdrassil-monitoringygdrassil

0.4.0

2 of 10 See more

ygdrassil-monitoring ygdrassil 0.4.0

2 of the 10 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :11.5.1	5781759b3d27	google.golang.org/grpc@v1.69.2	1.83.1
quay.io/prometheus/prometheus :v3.1.0	6559acbd5d77	google.golang.org/grpc@v1.69.0	1.83.1

Open the chart page →

9,526

matrixdb-operatorymatrix

0.13.0

1 of 2 See more

matrixdb-operator ymatrix 0.13.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/kubebuilder_kube-rbac-proxy :v0.12.0	ed3c7e6291e8	google.golang.org/grpc@v1.40.0	1.83.1

Open the chart page →

1,966

rawfile-csiymatrix

0.2.1

4 of 4 See more

rawfile-csi ymatrix 0.2.1

4 of the 4 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
matrixdb/custom-external-provisioner :4622a07d7-20220424	7e9ffe249a51	google.golang.org/grpc@v1.40.0	1.83.1
matrixdb/rawfile-csi :v0.2.1	95b2e38e913d	google.golang.org/grpc@v1.45.0	1.83.1
matrixdb/sig-storage_csi-node-driver-registrar :v2.2.0	ba763bb01ddc	google.golang.org/grpc@v1.36.0	1.83.1
matrixdb/sig-storage_livenessprobe :v2.3.0	7ab06fe3d8a7	google.golang.org/grpc@v1.36.0	1.83.1

Open the chart page →

8,002

prometheus-monitoring-stackyotron-helm-charts

1.2.0

3 of 3 See more

prometheus-monitoring-stack yotron-helm-charts 1.2.0

3 of the 3 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
grafana/grafana :latest	f772d434e8fa	google.golang.org/grpc@v1.81.1	1.83.1
quay.io/prometheus/alertmanager :latest	690c7b525f43	google.golang.org/grpc@v1.82.1	1.83.1
quay.io/prometheus/prometheus :latest	5ce7540c3c00	google.golang.org/grpc@v1.82.1	1.83.1

Open the chart page →

936

zahori-consulzahori

1.0.1

2 of 2 See more

zahori-consul zahori 1.0.1

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container image	Digest	Package	Fixed in
hashicorp/consul :1.15.3	ddff34041c5c	google.golang.org/grpc@v1.49.0	1.83.1
hashicorp/consul-k8s-control-plane :1.1.2	62bed1bf8106	google.golang.org/grpc@v1.49.0	1.83.1

Open the chart page →

5,077

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container image	Digest	Package	Fixed in	Used by
quay.io/thanos/thanos :v0.17.1	e362f02ed304	google.golang.org/grpc@v1.29.1	1.83.1	1
quay.io/thanos/thanos :v0.36.1	e542959e1b36	google.golang.org/grpc@v1.63.2	1.83.1	1
quay.io/uswitch/kiam :v4.0	be3a5846922d	google.golang.org/grpc@v1.34.0	1.83.1	1
quay.io/zncdatadev/airflow-operator :0.4.0	b716ef483b75	google.golang.org/grpc@v1.72.2	1.83.1	1
quay.io/zncdatadev/commons-operator :0.4.0	1a353def9fe1	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/dolphinscheduler-operator :0.4.0	d0a4e55eeb7f	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/hbase-operator :0.4.0	69e9a1b0daf8	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/hdfs-operator :0.4.0	eb3c2928250e	google.golang.org/grpc@v1.72.2	1.83.1	1
quay.io/zncdatadev/hive-operator :0.4.0	d66ba9149c22	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/kafka-operator :0.4.0	0a0b4c39c1ba	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/listener-csi-driver :0.4.0	b69bed123b02	google.golang.org/grpc@v1.81.0	1.83.1	1
quay.io/zncdatadev/listener-operator :0.4.0	68b92dae8d75	google.golang.org/grpc@v1.81.0	1.83.1	1
quay.io/zncdatadev/nifi-operator :0.4.0	bb4e26ff5e2f	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/secret-csi-driver :0.4.0	604a7d98ab58	google.golang.org/grpc@v1.78.0	1.83.1	1
quay.io/zncdatadev/spark-k8s-operator :0.4.0	d3f2b10c4a6d	google.golang.org/grpc@v1.72.2	1.83.1	1
quay.io/zncdatadev/superset-operator :0.4.0	102e66e32218	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/trino-operator :0.4.0	4f516757aee3	google.golang.org/grpc@v1.79.3	1.83.1	1
quay.io/zncdatadev/zookeeper-operator :0.4.0	b4f33d89ac45	google.golang.org/grpc@v1.79.3	1.83.1	1
registry.gitlab.com/arm-research/smarter/smarter-device-manager :v1.20.11	826b984e75d4	google.golang.org/grpc@v1.49.0	1.83.1	1
registry.gitlab.com/arm-research/smarter/smarter-device-manager :v1.20.7	864fc338571e	google.golang.org/grpc@v1.37.1	1.83.1	1
registry.gitlab.com/bitspur/rock8s/images/kube-commands :3.18	80ef8ceffc92	google.golang.org/grpc@v1.54.0	1.83.1	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-backend :1.0.31	c7afac3446d6	google.golang.org/grpc@v1.79.1	1.83.1	1
registry.gitlab.com/enbuild-staging/vivsoft-platform-ui/enbuild-mq-consumer :1.0.31	0e3cd8c7776d	google.golang.org/grpc@v1.79.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/certificates :v19.4.0	1c38ad710b0c	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitaly :v19.4.0	704cd68566af	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-base :v19.4.0	696d798a5c85	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-container-registry :v4.40.2-gitlab	dc1a8972c640	google.golang.org/grpc@v1.77.0	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-exporter :17.0.2	6645e014f75d	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-openbao :v2.5.5-gitlab2	5b7636dfba3f	google.golang.org/grpc@v1.80.0	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-shell :v14.57.3	aca1bb3d5b7e	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/build/cng/gitlab-workhorse-ee :v19.4.0	2256b49461fa	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.gitlab.com/gitlab-org/cloud-native/gitlab-operator :0.5.1	36b19b72120e	google.golang.org/grpc@v1.41.0	1.83.1	1
registry.gitlab.com/gitlab-org/gitlab-runner :alpine-v19.3.2	5448611a3c54	google.golang.org/grpc@v1.80.0	1.83.1	1
registry.gitlab.com/lenitech/k8s-operator/keycloak-client :v0.6.1	9065cdd80035	google.golang.org/grpc@v1.68.1	1.83.1	1
registry.gitlab.com/parrotsec/project/parrot-mirror-docker :main	f91b602ca572	google.golang.org/grpc@v1.56.2	1.83.1	1
registry.gitlab.com/shortlink-org/shortlink/bff :latest	f2194e526915	google.golang.org/grpc@v1.78.0	1.83.1	1
registry.gitlab.com/shortlink-org/shortlink/link :latest	86d87291ffd4	google.golang.org/grpc@v1.78.0	1.83.1	1
registry.gitlab.com/xrow-public/ci-tools/tools :main	9b9d1ed86b6a	google.golang.org/grpc@v1.82.1	1.83.1	1
registry.gitlab.com/xrow-public/developer-operator/developer-operator-controller :2.1.2	301847adfe16	google.golang.org/grpc@v1.73.0	1.83.1	1
registry.gitlab.com/xrow-public/velero-client/velero-client :1.4.2	03015f863a3e	google.golang.org/grpc@v1.81.1	1.83.1	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v0.5.4	be477ba317d8	google.golang.org/grpc@v1.82.1	1.83.1	1
registry.k8s.io/agent-sandbox/agent-sandbox-controller :v0.5.6	dc23fb0d5624	google.golang.org/grpc@v1.83.0	1.83.1	1
registry.k8s.io/autoscaling/cluster-autoscaler :v1.33.0	6ef10d108e0e	google.golang.org/grpc@v1.68.1	1.83.1	1
registry.k8s.io/autoscaling/cluster-autoscaler :v1.34.0	7b172f42533c	google.golang.org/grpc@v1.72.1	1.83.1	1
registry.k8s.io/capi-operator/cluster-api-operator :v0.29.0	465e72f8b06a	google.golang.org/grpc@v1.82.1	1.83.1	1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.28.0	026f63d9ed42	google.golang.org/grpc@v1.54.0	1.83.1	1
registry.k8s.io/cloud-pv-vsphere/cloud-provider-vsphere :v1.32.0	f9f4dfd733ab	google.golang.org/grpc@v1.65.0	1.83.1	1
registry.k8s.io/coredns/coredns :v1.13.2	94caebb89dcf	google.golang.org/grpc@v1.77.0	1.83.1	1
registry.k8s.io/csi-vsphere/driver :v3.5.0	4bb8350a5a62	google.golang.org/grpc@v1.68.1	1.83.1	1
registry.k8s.io/csi-vsphere/driver :v3.4.0	f5349a8ae3f3	google.golang.org/grpc@v1.67.1	1.83.1	1