StackRadar

CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,280
of 17,813 indexed, latest versions
Container images
2,705
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,280 of 17,813 indexed charts deploy, on 2,705 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,702
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed3
OSV records
GHSA-vp52-pcj8-j9qcUBUNTU-CVE-2026-84304
Also known as
GO-2026-6348

Charts affected

2,280 by stars
ChartLatestAffected imagesRadar Score
wazuh-manager-filebeatwazuh-manager-filebeat0.1.0-gamma1 of 1See more

wazuh-manager-filebeat wazuh-manager-filebeat 0.1.0-gamma

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
iosifache/wazuh-manager-filebeat:latest85df3f04b5da
google.golang.org/grpc@v1.29.1
1.83.1

Open the chart page →

11,208
anubiswbstack0.1.01 of 1See more

anubis wbstack 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/techarohq/anubis:v1.21.3940ac71ef6fc
google.golang.org/grpc@v1.73.0
1.83.1

Open the chart page →

481
istio-service-meshwbstack0.0.11 of 1See more

istio-service-mesh wbstack 0.0.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
istio/pilot:1.17.1ce9d87606701
google.golang.org/grpc@v1.52.3
1.83.1

Open the chart page →

6,302
webresourcecataloguswebresourcecatalogus1.1.01 of 4See more

webresourcecatalogus webresourcecatalogus 1.1.0

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/webresourcecatalogus-php:latest8f1bbd5cda85
google.golang.org/grpc@v1.27.0
1.83.1

Open the chart page →

7,563
valkey-operatorwellcakeVerified publisher0.8.11 of 1See more

valkey-operator wellcake 0.8.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/melancholictheory/wellcake:0.8.12fd2678f07ef
google.golang.org/grpc@v1.72.2
1.83.1

Open the chart page →

124
ambassadorwener6.9.51 of 2See more

ambassador wener 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
google.golang.org/grpc@v1.34.0
1.83.1

Open the chart page →

4,128
apisixwener2.17.01 of 3See more

apisix wener 2.17.0

1 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
bitnamilegacy/etcd:latest99b408c15272
google.golang.org/grpc@v1.71.1
1.83.1

Open the chart page →

3,183
apisix-ingress-controllerwener1.4.01 of 2See more

apisix-ingress-controller wener 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
apache/apisix-ingress-controller:2.2.05c5efa4c7f2a
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

1,713
argo-cdwener10.9.22 of 3See more

argo-cd wener 10.9.2

2 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/dexidp/dex:v2.45.18499afd690c4
google.golang.org/grpc@v1.79.1
1.83.1
quay.io/argoproj/argocd:v3.5.3dd3f47d5a5e4
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

3,042
argocd-image-updaterwener1.3.11 of 1See more

argocd-image-updater wener 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

733
argo-eventswener2.4.271 of 1See more

argo-events wener 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
google.golang.org/grpc@v1.72.2
1.83.1

Open the chart page →

1,093
argo-rolloutswener2.43.21 of 1See more

argo-rollouts wener 2.43.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-rollouts:v1.10.0187630ba7228
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

122
athens-proxywener0.5.22 of 2See more

athens-proxy wener 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
google.golang.org/grpc@v1.26.0
1.83.1
jaegertracing/all-in-one:latestab6f1a1f0fb4
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

5,009
cadencewener0.23.01 of 5See more

cadence wener 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ubercadence/server:0.23.22ac5491d13bb
google.golang.org/grpc@v1.29.1
1.83.1

Open the chart page →

10,151
daprwener1.18.45 of 5See more

dapr wener 1.18.4

5 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/dapr/injector:1.18.45ac0db7ca106
google.golang.org/grpc@v1.82.1
1.83.1
ghcr.io/dapr/operator:1.18.4af58fae3e7c9
google.golang.org/grpc@v1.82.1
1.83.1
ghcr.io/dapr/placement:1.18.490d2293f42a3
google.golang.org/grpc@v1.82.1
1.83.1
ghcr.io/dapr/scheduler:1.18.4239eac864320
google.golang.org/grpc@v1.82.1
1.83.1
ghcr.io/dapr/sentry:1.18.405286fc952e7
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

225
emissary-ingresswener8.12.21 of 2See more

emissary-ingress wener 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
google.golang.org/grpc@v1.67.0
1.83.1

Open the chart page →

77,221
external-secretswener2.10.01 of 1See more

external-secrets wener 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.10.0814117b0fd6d
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

89
gitlab-runnerwener0.93.01 of 1See more

gitlab-runner wener 0.93.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.4.0a4838319e55b
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

280
juicefs-csi-driverwener0.33.05 of 5See more

juicefs-csi-driver wener 0.33.0

5 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
juicedata/csi-dashboard:v0.33.05e5edb62a010
google.golang.org/grpc@v1.82.1
1.83.1
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
google.golang.org/grpc@v1.80.0
1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.0cd21e19cd8bb
google.golang.org/grpc@v1.58.0
1.83.1
registry.k8s.io/sig-storage/csi-resizer:v1.9.0f1f352df9787
google.golang.org/grpc@v1.54.0
1.83.1
registry.k8s.io/sig-storage/livenessprobe:v2.12.05baeb4a6d7d5
google.golang.org/grpc@v1.60.1
1.83.1

Open the chart page →

9,000
kube-prometheus-stackwener91.4.12 of 6See more

kube-prometheus-stack wener 91.4.1

2 of the 6 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/grafana:13.2.2-distroless69a5d2d957ca
google.golang.org/grpc@v1.81.1
1.83.1
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

682
kube-state-metricswener8.5.01 of 1See more

kube-state-metrics wener 8.5.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

96
longhornwener1.2.31 of 2See more

longhorn wener 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
google.golang.org/grpc@v1.26.0
1.83.1

Open the chart page →

15,483
mesherywener1.0.701 of 1See more

meshery wener 1.0.70

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest44b64ee128fb
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

1,497
openebswener3.10.02 of 3See more

openebs wener 3.10.0

2 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
openebs/node-disk-manager:2.1.0f6c18b0f8c8a
google.golang.org/grpc@v1.47.0
1.83.1
openebs/provisioner-localpv:3.5.0aea39e49bb97
google.golang.org/grpc@v1.55.0
1.83.1

Open the chart page →

10,631
prometheus-blackbox-exporterwener11.18.01 of 1See more

prometheus-blackbox-exporter wener 11.18.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/prometheus/blackbox-exporter:v0.28.0e753ff9f3fc4
google.golang.org/grpc@v1.77.0
1.83.1

Open the chart page →

600
rancherwener2.15.12 of 2See more

rancher wener 2.15.1

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
rancher/rancher:v2.15.15f6c4dc52a05
google.golang.org/grpc@v1.79.3
1.83.1
rancher/shell:v0.8.1f293af9c635f
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

1,534
temporalwener0.15.14 of 13See more

temporal wener 0.15.1

4 of the 13 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/grafana:6.7.11ff3999e0fc0
google.golang.org/grpc@v1.23.1
1.83.1
prom/prometheus:v2.16.0e4ca62c0d62f
google.golang.org/grpc@v1.22.1
1.83.1
temporalio/admin-tools:1.15.135034611d981
google.golang.org/grpc@v1.44.0
1.83.1
temporalio/server:1.15.1e26758f5a1bf
google.golang.org/grpc@v1.44.0
1.83.1

Open the chart page →

22,715
traefikwener9.1.11 of 1See more

traefik wener 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
library/traefik:2.2.8f5af5a5ce17f
google.golang.org/grpc@v1.27.1
1.83.1

Open the chart page →

3,379
vaultwener0.34.11 of 2See more

vault wener 0.34.1

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/vault:2.0.45be49781ecf7
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

552
victoria-metrics-k8s-stackwener0.92.13 of 7See more

victoria-metrics-k8s-stack wener 0.92.1

3 of the 7 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/grafana:13.1.17cb8c64c4d57
google.golang.org/grpc@v1.81.1
1.83.1
victoriametrics/operator:v0.74.17310c4a80b94
google.golang.org/grpc@v1.82.1
1.83.1
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.185108987d044
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

1,954
victoria-metrics-operatorwener0.67.31 of 1See more

victoria-metrics-operator wener 0.67.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
victoriametrics/operator:v0.74.17310c4a80b94
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

125
ambassadorwenerme6.9.51 of 2See more

ambassador wenerme 6.9.5

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
datawire/aes:1.14.48588eafe6862
google.golang.org/grpc@v1.34.0
1.83.1

Open the chart page →

4,128
apisixwenerme2.17.01 of 3See more

apisix wenerme 2.17.0

1 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
bitnamilegacy/etcd:latest99b408c15272
google.golang.org/grpc@v1.71.1
1.83.1

Open the chart page →

3,183
apisix-ingress-controllerwenerme1.4.01 of 2See more

apisix-ingress-controller wenerme 1.4.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
apache/apisix-ingress-controller:2.2.05c5efa4c7f2a
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

1,713
argocd-image-updaterwenerme1.3.11 of 1See more

argocd-image-updater wenerme 1.3.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/argoprojlabs/argocd-image-updater:v1.3.0cb009167015c
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

733
argo-eventswenerme2.4.271 of 1See more

argo-events wenerme 2.4.27

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-events:v1.9.11fa07b2c9ece6
google.golang.org/grpc@v1.72.2
1.83.1

Open the chart page →

1,093
argo-rolloutswenerme2.43.21 of 1See more

argo-rollouts wenerme 2.43.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/argoproj/argo-rollouts:v1.10.0187630ba7228
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

122
athens-proxywenerme0.5.22 of 2See more

athens-proxy wenerme 0.5.2

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gomods/athens:v0.11.0efb811df7844
google.golang.org/grpc@v1.26.0
1.83.1
jaegertracing/all-in-one:latestab6f1a1f0fb4
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

5,009
cadencewenerme0.23.01 of 5See more

cadence wenerme 0.23.0

1 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ubercadence/server:0.23.22ac5491d13bb
google.golang.org/grpc@v1.29.1
1.83.1

Open the chart page →

10,151
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
google.golang.org/grpc@v1.67.0
1.83.1

Open the chart page →

77,221
external-secretswenerme2.10.01 of 1See more

external-secrets wenerme 2.10.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/external-secrets/external-secrets:v2.10.0814117b0fd6d
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

89
gitlab-runnerwenerme0.93.01 of 1See more

gitlab-runner wenerme 0.93.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.4.0a4838319e55b
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

280
harborwenerme1.19.25 of 8See more

harbor wenerme 1.19.2

5 of the 8 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.15.2d7b780d23721
google.golang.org/grpc@v1.81.1
1.83.1
goharbor/harbor-jobservice:v2.15.2f71a4452a095
google.golang.org/grpc@v1.81.1
1.83.1
goharbor/harbor-registryctl:v2.15.2223d5cb49d5d
google.golang.org/grpc@v0.0.0-20160317175043-d3ddb4469d5a
1.83.1
goharbor/registry-photon:v2.15.2c4ebef61ceb5
google.golang.org/grpc@v0.0.0-20160317175043-d3ddb4469d5a
1.83.1
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
google.golang.org/grpc@v1.81.0
1.83.1

Open the chart page →

1,739
juicefs-csi-driverwenerme0.33.05 of 5See more

juicefs-csi-driver wenerme 0.33.0

5 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
juicedata/csi-dashboard:v0.33.05e5edb62a010
google.golang.org/grpc@v1.82.1
1.83.1
juicedata/juicefs-csi-driver:v0.33.0f918e7331c05
google.golang.org/grpc@v1.80.0
1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.9.0cd21e19cd8bb
google.golang.org/grpc@v1.58.0
1.83.1
registry.k8s.io/sig-storage/csi-resizer:v1.9.0f1f352df9787
google.golang.org/grpc@v1.54.0
1.83.1
registry.k8s.io/sig-storage/livenessprobe:v2.12.05baeb4a6d7d5
google.golang.org/grpc@v1.60.1
1.83.1

Open the chart page →

9,000
kube-state-metricswenerme8.5.01 of 1See more

kube-state-metrics wenerme 8.5.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.042cfe3723a5f
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

96
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
google.golang.org/grpc@v1.26.0
1.83.1

Open the chart page →

15,483
mesherywenerme1.0.701 of 1See more

meshery wenerme 1.0.70

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
meshery/meshery:stable-latest44b64ee128fb
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

1,497
miniowenerme8.0.101 of 1See more

minio wenerme 8.0.10

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2021-02-14T04-01-33Zbd11edda91f3
google.golang.org/grpc@v1.26.0
1.83.1

Open the chart page →

6,950
minio-standalonewenerme1.0.21 of 1See more

minio-standalone wenerme 1.0.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
minio/minio:RELEASE.2022-01-04T07-41-07Z1484c87239ea
google.golang.org/grpc@v1.41.0
1.83.1

Open the chart page →

6,173
openebswenerme3.10.02 of 3See more

openebs wenerme 3.10.0

2 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
openebs/node-disk-manager:2.1.0f6c18b0f8c8a
google.golang.org/grpc@v1.47.0
1.83.1
openebs/provisioner-localpv:3.5.0aea39e49bb97
google.golang.org/grpc@v1.55.0
1.83.1

Open the chart page →

10,631

Container images carrying it

2,705 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/livenessprobe:v2.9.02b10b24dafdc
google.golang.org/grpc@v1.49.0
1.83.1
1
registry.k8s.io/sig-storage/livenessprobe:v2.11.082adbebdf5d5
google.golang.org/grpc@v1.58.0
1.83.1
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
google.golang.org/grpc@v1.79.3
1.83.1
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
google.golang.org/grpc@v1.71.0
1.83.1
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
google.golang.org/grpc@v1.74.2
1.83.1
1

syft 1.42.1 · advisories as of 19 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.