StackRadar

CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,305
of 17,813 indexed, latest versions
Container images
2,756
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,752
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed4
OSV records
GHSA-vp52-pcj8-j9qcUBUNTU-CVE-2026-84304
Also known as
GO-2026-6348

Charts affected

2,305 by stars
ChartLatestAffected imagesRadar Score
oauth2-proxyhelmforgeVerified publisher1.0.61 of 1See more

oauth2-proxy helmforge 1.0.6

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/oauth2-proxy/oauth2-proxy:v7.15.4b1b2021fe8f4
google.golang.org/grpc@v1.83.0
1.83.1

Open the chart page →

54
opencloudhelmforgeVerified publisher1.0.01 of 1See more

opencloud helmforge 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
opencloudeu/opencloud:7.2.46d992ccc5f1c
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

678
pimcorehelmforgeVerified publisher2.0.11 of 6See more

pimcore helmforge 2.0.1

1 of the 6 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
dunglas/mercure:v0.24.2916834e49961
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

3,258
pocket-idhelmforgeVerified publisher1.0.01 of 2See more

pocket-id helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/pocket-id/pocket-id:v2.14.001540977dcf4
google.golang.org/grpc@v1.83.0
1.83.1

Open the chart page →

466
ryothelmforgeVerified publisher1.0.01 of 2See more

ryot helmforge 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/ignisda/ryot:v10.5.0a752b6aee537
google.golang.org/grpc@v1.67.1
1.83.1

Open the chart page →

6,170
strava-statisticshelmforgeVerified publisher1.1.161 of 2See more

strava-statistics helmforge 1.1.16

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
robiningelbrecht/strava-statistics:v5.0.040842cdfd616
google.golang.org/grpc@v1.81.0
1.83.1

Open the chart page →

863
harborhelm-harborVerified publisher2.3.55 of 8See more

harbor helm-harbor 2.3.5

5 of the 8 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
goharbor/harbor-core:v2.15.2d7b780d23721
google.golang.org/grpc@v1.81.1
1.83.1
goharbor/harbor-jobservice:v2.15.2f71a4452a095
google.golang.org/grpc@v1.81.1
1.83.1
goharbor/harbor-registryctl:v2.15.2223d5cb49d5d
google.golang.org/grpc@v0.0.0-20160317175043-d3ddb4469d5a
1.83.1
goharbor/registry-photon:v2.15.2c4ebef61ceb5
google.golang.org/grpc@v0.0.0-20160317175043-d3ddb4469d5a
1.83.1
goharbor/trivy-adapter-photon:v2.15.2215c07b71c37
google.golang.org/grpc@v1.81.0
1.83.1

Open the chart page →

1,739
openbashelm-openbasVerified publisher1.8.142 of 7See more

openbas helm-openbas 1.8.14

2 of the 7 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2024-11-21T17-21-54Z993e8c454a7e
google.golang.org/grpc@v1.67.1
1.83.1
quay.io/minio/minio:RELEASE.2024-12-18T13-15-44Z1dce27c494a1
google.golang.org/grpc@v1.69.0
1.83.1

Open the chart page →

25,603
steampipehelm-steampipeVerified publisher2.4.11 of 1See more

steampipe helm-steampipe 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/devops-ia/steampipe:v2.4.1a982103d91d3
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

3,216
svacerhelm-svacer0.6.01 of 1See more

svacer helm-svacer 0.6.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ispras/svacer:11-2-042aa9fa9f189
google.golang.org/grpc@v1.72.0
1.83.1

Open the chart page →

6,129
goshimmerhiveroad0.2.141 of 1See more

goshimmer hiveroad 0.2.14

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
iotaledger/goshimmer:v0.8.6b02a8f77474f
google.golang.org/grpc@v1.40.0
1.83.1

Open the chart page →

2,552
cratedb-adapterhmdmph0.1.01 of 1See more

cratedb-adapter hmdmph 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
crate/crate_adapter:latestb8d89fa5d19b
google.golang.org/grpc@v1.37.0
1.83.1

Open the chart page →

2,921
imageproxyhmphuVerified publisher0.1.11 of 1See more

imageproxy hmphu 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
willnorris/imageproxy:latest21d0c90f4c31
google.golang.org/grpc@v1.40.0
1.83.1

Open the chart page →

2,148
homeboxhomebox-helmVerified publisher0.3.01 of 2See more

homebox homebox-helm 0.3.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
sysadminsmedia/homebox:0.26.056e880b62309
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

697
cert-managerhomeenterpriseinc1.10.12 of 3See more

cert-manager homeenterpriseinc 1.10.1

2 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.10.11143471c90db
google.golang.org/grpc@v1.47.0
1.83.1
quay.io/jetstack/cert-manager-webhook:v1.10.164121721c665
google.golang.org/grpc@v1.47.0
1.83.1

Open the chart page →

4,736
hoppscotchhoppscotch0.1.11 of 1See more

hoppscotch hoppscotch 0.1.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.11.0538fe6ded4b6
google.golang.org/grpc@v1.59.0
1.83.1

Open the chart page →

3,645
universal-web-apphotrungnhanVerified publisher0.2.61 of 2See more

universal-web-app hotrungnhan 0.2.6

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
traefik/whoami:latestc4717a8d1f01
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

93
paperlesshpVerified publisher0.1.21 of 5See more

paperless hp 0.1.2

1 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.3467097317623a
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

27,657
hammerspace-csihscsi1.2.86 of 6See more

hammerspace-csi hscsi 1.2.8

6 of the 6 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hammerspaceinc/csi-plugin:v1.2.8-rc2395bee4504fc
google.golang.org/grpc@v1.68.1
1.83.1
registry.k8s.io/sig-storage/csi-attacher:v4.8.0a399393ff5bd
google.golang.org/grpc@v1.69.0
1.83.1
registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.13.0d7138bcc3aa5
google.golang.org/grpc@v1.69.0
1.83.1
registry.k8s.io/sig-storage/csi-provisioner:v5.2.0d5e46da8aff7
google.golang.org/grpc@v1.69.2
1.83.1
registry.k8s.io/sig-storage/csi-resizer:v1.14.05e7cbb63fd49
google.golang.org/grpc@v1.69.2
1.83.1
registry.k8s.io/sig-storage/csi-snapshotter:v8.0.25f051159c95f
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

4,519
cac-systemhuangchengwu-helm-chart0.1.04 of 9See more

cac-system huangchengwu-helm-chart 0.1.0

4 of the 9 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
huangchengwu6904/hi-app:cac-16910478061b932f8221a9
google.golang.org/grpc@v1.49.0
1.83.1
quay.io/jetstack/cert-manager-controller:v1.12.04a9d0264055b
google.golang.org/grpc@v1.54.0
1.83.1
quay.io/jetstack/cert-manager-ctl:v1.12.08d54fe9d0c0d
google.golang.org/grpc@v1.54.0
1.83.1
quay.io/jetstack/cert-manager-webhook:v1.12.0ec4306b243d9
google.golang.org/grpc@v1.54.0
1.83.1

Open the chart page →

11,265
prometheushuangchengwu-helm-chart0.1.01 of 3See more

prometheus huangchengwu-helm-chart 0.1.0

1 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:9.2.0133d35d2c263
google.golang.org/grpc@v1.38.0
1.83.1

Open the chart page →

16,577
skywalking-v1huangchengwu-helm-chart0.1.01 of 4See more

skywalking-v1 huangchengwu-helm-chart 0.1.0

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
apache/skywalking-oap-server:8.9.1b4ec8c18d079
google.golang.org/grpc@v1.38.0
1.83.1

Open the chart page →

20,796
s-uihuscker-chartsVerified publisher1.0.31 of 1See more

s-ui huscker-charts 1.0.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
alireza7/s-ui:1.5.302aa86983cdb
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

532
jaegerhuseyinbabalVerified publisher0.1.02 of 3See more

jaeger huseyinbabal 0.1.0

2 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:latestab6f1a1f0fb4
google.golang.org/grpc@v1.76.0
1.83.1
quay.io/prometheus/prometheus:latest5ce7540c3c00
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

1,625
vcwaltidi4trustVerified publisher0.0.191 of 1See more

vcwaltid i4trust 0.0.19

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/fiware/waltid:1.14.1-SNAPSHOT93889c3d8a34
google.golang.org/grpc@v1.53.0
1.83.1

Open the chart page →

8,084
stoloniamalryz0.10.01 of 2See more

stolon iamalryz 0.10.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
sorintlab/stolon:v0.16.0-pg1236b45c0f97fc
google.golang.org/grpc@v1.23.1
1.83.1

Open the chart page →

4,053
monitoring-stackict-platformVerified publisher0.4.03 of 13See more

monitoring-stack ict-platform 0.4.0

3 of the 13 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/loki:3.6.73c8fd3570dd9
google.golang.org/grpc@v1.75.1
1.83.1
ghcr.io/grafana/alloy-operator:1.7.02ce23f948e02
google.golang.org/grpc@v1.75.1
1.83.1
registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.18.01545919b72e3
google.golang.org/grpc@v1.75.1
1.83.1

Open the chart page →

9,708
ilum-apiilumVerified publisher6.7.31 of 1See more

ilum-api ilum 6.7.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ilum/api:6.7.3624fd09528c8
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

2,252
ilum-jupyterhubilumVerified publisher4.3.11 of 6See more

ilum-jupyterhub ilum 4.3.1

1 of the 6 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
registry.k8s.io/kube-scheduler:v1.30.1474a5cf9cfa9f
google.golang.org/grpc@v1.58.3
1.83.1

Open the chart page →

1,997
ilum-otel-collectorilumVerified publisher0.1.01 of 1See more

ilum-otel-collector ilum 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
otel/opentelemetry-collector-contrib:0.113.05ac3e0ba2b0b
google.golang.org/grpc@v1.67.1
1.83.1

Open the chart page →

1,525
kore-boardimprowisedVerified publisher0.5.81 of 4See more

kore-board improwised 0.5.8

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/kore3lab/kore-board.terminal:v0.5.5f52e66eff50b
google.golang.org/grpc@v1.47.0
1.83.1

Open the chart page →

16,421
fpga-cloudinaccelVerified publisher1.2.22 of 3See more

fpga-cloud inaccel 1.2.2

2 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
inaccel/cloud-init:latesta5d3d0af05c1
google.golang.org/grpc@v1.60.1
1.83.1
inaccel/device-selector:latest44b4f274f40b
google.golang.org/grpc@v1.61.0
1.83.1

Open the chart page →

3,166
fpga-operatorinaccelVerified publisher2.8.21 of 7See more

fpga-operator inaccel 2.8.2

1 of the 7 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
inaccel/daemon:latest093e1ea90ab8
google.golang.org/grpc@v1.61.0
1.83.1

Open the chart page →

5,785
infisicalinfisical-charts0.4.21 of 3See more

infisical infisical-charts 0.4.2

1 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
infisical/infisical:latest02082bf13163
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

3,114
infisical-csi-providerinfisical-charts0.2.31 of 1See more

infisical-csi-provider infisical-charts 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
infisical/infisical-csi-provider:v0.0.9e3390e677db6
google.golang.org/grpc@v1.64.1
1.83.1

Open the chart page →

636
infisical-gatewayinfisical-charts1.4.01 of 1See more

infisical-gateway infisical-charts 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
infisical/cli:0.43.1230941c1293b77
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

293
infisical-pki-issuerinfisical-charts1.0.01 of 1See more

infisical-pki-issuer infisical-charts 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
infisical/pki-issuer:latestff38294270e3
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

580
secrets-operatorinfisical-charts0.11.91 of 1See more

secrets-operator infisical-charts 0.11.9

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
infisical/kubernetes-operator:v0.11.9769ad1630a13
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

102
chronografinfluxdata1.2.61 of 1See more

chronograf influxdata 1.2.6

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
library/chronograf:1.9.496d8a3f65a4f
google.golang.org/grpc@v1.37.0
1.83.1

Open the chart page →

2,205
influxdb-enterpriseinfluxdata0.2.11 of 2See more

influxdb-enterprise influxdata 0.2.1

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
library/influxdb:1.12.3-datab0f9fc41ed79
google.golang.org/grpc@v1.64.1
1.83.1

Open the chart page →

6,042
influxdbinfluxdb20.1.01 of 1See more

influxdb influxdb2 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
library/influxdb:latestf75e48af0598
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

2,389
erigoninfradao0.0.51 of 2See more

erigon infradao 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
testinprod/op-erigon:latest0a125bd77a2d
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

2,932
registry-container-webhookinnagoVerified publisher2.0.21 of 1See more

registry-container-webhook innago 2.0.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/indeedeng/harbor-container-webhook:main45ca15fc294f
google.golang.org/grpc@v1.71.0
1.83.1

Open the chart page →

600
cloudshellinseefrlab4.3.01 of 2See more

cloudshell inseefrlab 4.3.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
inseefrlab/shelly:cloudshell31f04ca7436b
google.golang.org/grpc@v1.33.1
1.83.1

Open the chart page →

10,601
lakefsinseefrlab0.0.61 of 2See more

lakefs inseefrlab 0.0.6

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
treeverse/lakefs:0.69.0478f37a6cffc
google.golang.org/grpc@v1.45.0
1.83.1

Open the chart page →

2,654
instemmingserviceinstemmingservice1.0.01 of 3See more

instemmingservice instemmingservice 1.0.0

1 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/conductionnl/instemmingservice-php:latest4ffe222b3e3a
google.golang.org/grpc@v1.27.0
1.83.1

Open the chart page →

7,521
consulintelVerified publisher0.8.12 of 2See more

consul intel 0.8.1

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/consul:1.14.2e38576edcdfd
google.golang.org/grpc@v1.49.0
1.83.1
hashicorp/consul-k8s-control-plane:1.0.2538a3436398d
google.golang.org/grpc@v1.19.0
1.83.1

Open the chart page →

5,430
evi-consulintelVerified publisher3.0.32 of 2See more

evi-consul intel 3.0.3

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/consul:1.14.2e38576edcdfd
google.golang.org/grpc@v1.49.0
1.83.1
hashicorp/consul-k8s-control-plane:1.0.2538a3436398d
google.golang.org/grpc@v1.19.0
1.83.1

Open the chart page →

5,430
evi-kesintelVerified publisher3.0.31 of 1See more

evi-kes intel 3.0.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
minio/kes:2023-04-03T16-41-28Zf93c2d9088df
google.golang.org/grpc@v1.50.1
1.83.1

Open the chart page →

1,766
evi-miniointelVerified publisher3.0.32 of 2See more

evi-minio intel 3.0.3

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/minio/mc:RELEASE.2023-01-28T20-29-38Zad34abeba912
google.golang.org/grpc@v1.50.1
1.83.1
quay.io/minio/minio:RELEASE.2023-02-10T18-48-39Za0a002cb113c
google.golang.org/grpc@v1.52.3
1.83.1

Open the chart page →

7,614

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
google.golang.org/grpc@v1.34.0
1.83.1
1
registry.k8s.io/sig-storage/livenessprobe:v2.9.02b10b24dafdc
google.golang.org/grpc@v1.49.0
1.83.1
1
registry.k8s.io/sig-storage/livenessprobe:v2.11.082adbebdf5d5
google.golang.org/grpc@v1.58.0
1.83.1
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
google.golang.org/grpc@v1.79.3
1.83.1
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
google.golang.org/grpc@v1.71.0
1.83.1
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
google.golang.org/grpc@v1.74.2
1.83.1
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.