StackRadar

CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,305
of 17,813 indexed, latest versions
Container images
2,756
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,305 of 17,813 indexed charts deploy, on 2,756 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,752
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed4
OSV records
GHSA-vp52-pcj8-j9qcUBUNTU-CVE-2026-84304
Also known as
GO-2026-6348

Charts affected

2,305 by stars
ChartLatestAffected imagesRadar Score
evi-vaultintelVerified publisher3.0.31 of 2See more

evi-vault intel 3.0.3

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/vault:1.12.18de4d5f31b38
google.golang.org/grpc@v1.47.0
1.83.1

Open the chart page →

4,488
intel-gaudi-resource-driverintelVerified publisher0.3.01 of 1See more

intel-gaudi-resource-driver intel 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
intel/intel-gaudi-resource-driver:v0.3.0ac758c14c2de
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

566
intel-qat-resource-driverintelVerified publisher0.1.01 of 1See more

intel-qat-resource-driver intel 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
intel/intel-qat-resource-driver:v0.1.0ac7616986a2b
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

609
kesintelVerified publisher0.8.31 of 1See more

kes intel 0.8.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
minio/kes:v0.22.255f3aef5803e
google.golang.org/grpc@v1.50.1
1.83.1

Open the chart page →

3,578
multimodal-data-visualizationintelVerified publisher3.0.01 of 2See more

multimodal-data-visualization intel 3.0.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
intel/multimodal-data-visualization:3.03426deb77337
google.golang.org/grpc@v1.45.0
1.83.1

Open the chart page →

81,916
vaultintelVerified publisher0.8.11 of 2See more

vault intel 0.8.1

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/vault:1.12.18de4d5f31b38
google.golang.org/grpc@v1.47.0
1.83.1

Open the chart page →

4,488
karpenteriometeVerified publisher0.19.31 of 1See more

karpenter iomete 0.19.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
public.ecr.aws/karpenter/controller:v0.19.3f0e5ab60b2df
google.golang.org/grpc@v1.47.0
1.83.1

Open the chart page →

1,556
server-monitoringiserversupport-helm--charts1.0.01 of 2See more

server-monitoring iserversupport-helm--charts 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
prom/prometheus:v3.8.0d936808bdea5
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

1,331
istio-aws-private-ingress-customizedistio-aws-private-ingress-customized1.0.01 of 1See more

istio-aws-private-ingress-customized istio-aws-private-ingress-customized 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
istio/proxyv2:1.18.0757d28c24100
google.golang.org/grpc@v1.54.0
1.83.1

Open the chart page →

5,600
istio-azure-private-ingress-customizedistio-azure-private-ingress-customized1.0.01 of 1See more

istio-azure-private-ingress-customized istio-azure-private-ingress-customized 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
istio/proxyv2:1.18.0757d28c24100
google.golang.org/grpc@v1.54.0
1.83.1

Open the chart page →

5,600
hetzner-dyndnsitsmethemojoVerified publisher1.4.01 of 1See more

hetzner-dyndns itsmethemojo 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/terraform:1.9.7b77efab1a448
google.golang.org/grpc@v1.59.0
1.83.1

Open the chart page →

1,854
thehiveittrident-oss0.1.01 of 6See more

thehive ittrident-oss 0.1.0

1 of the 6 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
google.golang.org/grpc@v1.71.0
1.83.1

Open the chart page →

6,343
jaasjaasVerified publisher2026.6.15+1013541 of 1See more

jaas jaas 2026.6.15+101354

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/metio/jaas:2026.6.15e28772028e56
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

360
opencloudjacobcolvinVerified publisher0.2.32 of 13See more

opencloud jacobcolvin 0.2.3

2 of the 13 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
minio/minio:latest14cea493d9a3
google.golang.org/grpc@v1.71.0
1.83.1
opencloudeu/opencloud-rolling:2.1.0f9634bb04905
google.golang.org/grpc@v1.71.1
1.83.1

Open the chart page →

46,016
rclonejacobcolvinVerified publisher1.0.11 of 1See more

rclone jacobcolvin 1.0.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
rclone/rclone:1.63.008e1af3c8814
google.golang.org/grpc@v1.54.0
1.83.1

Open the chart page →

2,151
koptimizejaconiVerified publisher0.5.42 of 2See more

koptimize jaconi 0.5.4

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
alpine/k8s:1.27.321b24e6bf801
google.golang.org/grpc@v1.53.0
1.83.1
ghcr.io/jaconi-io/koptimize:1.2.5aca1bbd609b6
google.golang.org/grpc@v1.55.0
1.83.1

Open the chart page →

5,739
janus-shieldjanus-shield1.0.01 of 2See more

janus-shield janus-shield 1.0.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/cilium/tetragon:v1.1.096fac2482898
google.golang.org/grpc@v1.63.2
1.83.1

Open the chart page →

2,443
newtjeffrescVerified publisher0.2.11 of 1See more

newt jeffresc 0.2.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
fosrl/newt:1.10.4ccd2b0e9a049
google.golang.org/grpc@v1.79.1
1.83.1

Open the chart page →

1,113
athens-proxyjenkins-x0.2.21 of 2See more

athens-proxy jenkins-x 0.2.2

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
jaegertracing/all-in-one:latestab6f1a1f0fb4
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

1,353
jx-app-athensjenkins-x0.0.181 of 1See more

jx-app-athens jenkins-x 0.0.18

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gomods/athens:v0.8.1d714c7ff0231
google.golang.org/grpc@v1.20.1
1.83.1

Open the chart page →

4,233
jx-app-datadogjenkins-x0.0.101 of 2See more

jx-app-datadog jenkins-x 0.0.10

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
datadog/agent:6aad9994de6a7
google.golang.org/grpc@v1.62.1
1.83.1

Open the chart page →

4,105
jx-app-flaggerjenkins-x0.0.51 of 2See more

jx-app-flagger jenkins-x 0.0.5

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/grafana:6.5.1befcd84da2c1
google.golang.org/grpc@v1.23.1
1.83.1

Open the chart page →

6,037
knative-servingjenkins-x0.19.124 of 4See more

knative-serving jenkins-x 0.19.12

4 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gcr.io/knative-releases/knative.dev/serving/cmd/activatordigest-pinned1e3db4f2eeed
google.golang.org/grpc@v1.33.1
1.83.1
gcr.io/knative-releases/knative.dev/serving/cmd/autoscalerdigest-pinneddb6ceff2aab4
google.golang.org/grpc@v1.33.1
1.83.1
gcr.io/knative-releases/knative.dev/serving/cmd/controllerdigest-pinnedb2cd45b8a8a4
google.golang.org/grpc@v1.33.1
1.83.1
gcr.io/knative-releases/knative.dev/serving/cmd/webhookdigest-pinnedd27b4495ccc3
google.golang.org/grpc@v1.33.1
1.83.1

Open the chart page →

9,728
vaultjfrog0.25.01 of 2See more

vault jfrog 0.25.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/vault:1.14.0b2177a8bfe85
google.golang.org/grpc@v1.55.0
1.83.1

Open the chart page →

3,981
missing-container-metricsjimdo-missing-container-metrics0.5.01 of 1See more

missing-container-metrics jimdo-missing-container-metrics 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
dmilhdef/missing-container-metrics:v0.21.0fada1a6e7638
google.golang.org/grpc@v1.36.0
1.83.1

Open the chart page →

2,419
job-manager-syncerjob-manager-syncer1.27.01 of 1See more

job-manager-syncer job-manager-syncer 1.27.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/job-manager-syncer:1.27.086957bbeeff5
google.golang.org/grpc@v1.67.0
1.83.1

Open the chart page →

462
cloudnative-pgjouveVerified publisher0.27.01 of 1See more

cloudnative-pg jouve 0.27.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/cloudnative-pg/cloudnative-pg:1.28.034198e85b6e6
google.golang.org/grpc@v1.77.0
1.83.1

Open the chart page →

654
corednsjouveVerified publisher1.45.01 of 1See more

coredns jouve 1.45.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
coredns/coredns:1.13.19b9128672209
google.golang.org/grpc@v1.75.1
1.83.1

Open the chart page →

923
distributionjouveVerified publisher0.2.31 of 1See more

distribution jouve 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
distribution/distribution:3.1.1bca24727f400
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

861
time-series-storagejtektVerified publisher0.1.101 of 2See more

time-series-storage jtekt 0.1.10

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
bitnamilegacy/influxdb:2.6.1-debian-11-r18d17df1f9d745
google.golang.org/grpc@v1.47.0
1.83.1

Open the chart page →

16,834
daily-restartjuniorjpdj0.1.711 of 1See more

daily-restart juniorjpdj 0.1.71

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/juniorjpdj/containers/openssl-kubectl:1.36.1-r47d576be7f838
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

467
mumbledjjuniorjpdj0.1.2011 of 2See more

mumbledj juniorjpdj 0.1.201

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/juniorjpdj/containers/openssl-kubectl:1.36.1-r47d576be7f838
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

957
nginx-gateway-fabricjupyter-jscVerified publisher2.4.11 of 1See more

nginx-gateway-fabric jupyter-jsc 2.4.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/nginx/nginx-gateway-fabric:2.4.180f3a0a51af5
google.golang.org/grpc@v1.78.0
1.83.1

Open the chart page →

373
k8s-aibomk8s-aibomVerified publisher1.4.01 of 1See more

k8s-aibom k8s-aibom 1.4.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/googlecloudplatform/k8s-aibomdigest-pinned05e86c39c535
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

82
deploydefenderk8s-custom-controllerVerified publisher0.1.31 of 1See more

deploydefender k8s-custom-controller 0.1.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/manzil-infinity180/deploydefender:ea3ab0bb646cdbeddd1aca483ecf650f9ac0d0847fbc6855c8b3
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

1,905
k8s-dev-podk8s-dev-pod0.3.11 of 1See more

k8s-dev-pod k8s-dev-pod 0.3.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/bryopsida/k8s-dev-pod:main82d0b161161d
google.golang.org/grpc@v1.68.1
1.83.1

Open the chart page →

67,567
giteak8s-home-lab-repo2.6.01 of 1See more

gitea k8s-home-lab-repo 2.6.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gitea/gitea:1.26.27d13848af126
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

2,143
maddyk8s-home-lab-repo4.2.11 of 1See more

maddy k8s-home-lab-repo 4.2.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
foxcpp/maddy:0.8.2eeb5813fc4d1
google.golang.org/grpc@v1.70.0
1.83.1

Open the chart page →

1,205
librephotosk8sonlabVerified publisher1.1.61 of 7See more

librephotos k8sonlab 1.1.6

1 of the 7 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
alpine/k8s:1.22.600ac10bcb759
google.golang.org/grpc@v1.30.0
1.83.1

Open the chart page →

15,070
k8s-redirectsk8s-redirects1.0.01 of 1See more

k8s-redirects k8s-redirects 1.0.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
traefik/whoami:latestc4717a8d1f01
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

93
k8s-s3-bucket-operatork8s-s3-bucket-operator0.2.21 of 1See more

k8s-s3-bucket-operator k8s-s3-bucket-operator 0.2.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/devangradadiya/k8s-s3-bucket-operator:0.2.258288de9f9fa
google.golang.org/grpc@v1.72.2
1.83.1

Open the chart page →

535
kagentkagent0.10.13 of 6See more

kagent kagent 0.10.1

3 of the 6 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
mcp/grafana:latest9362bcf6aa0e
google.golang.org/grpc@v1.80.0
1.83.1
ghcr.io/kagent-dev/kagent/tools:0.2.150b431281d3e
google.golang.org/grpc@v1.79.3
1.83.1
ghcr.io/kagent-dev/kmcp/controller:0.3.086ab878da25a
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

3,095
gpu-provisionerkaitoVerified publisher0.2.01 of 1See more

gpu-provisioner kaito 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
mcr.microsoft.com/aks/kaito/gpu-provisioner:0.2.01204a7e948e9
google.golang.org/grpc@v1.56.3
1.83.1

Open the chart page →

1,045
ragenginekaitoVerified publisher0.12.01 of 1See more

ragengine kaito 0.12.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
mcr.microsoft.com/aks/kaito/ragengine:0.12.07bfe651c92db
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

37
workspacekaitoVerified publisher0.12.06 of 7See more

workspace kaito 0.12.0

6 of the 7 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
mcr.microsoft.com/acstor/local-csi-driver:v0.3.0f9af53a79fd1
google.golang.org/grpc@v1.83.0
1.83.1
mcr.microsoft.com/acstor/local-csi-manager:v0.3.04f464b52ba85
google.golang.org/grpc@v1.83.0
1.83.1
mcr.microsoft.com/aks/kaito/workspace:0.12.0c4b887ca0542
google.golang.org/grpc@v1.82.1
1.83.1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-provisioner:v5.2.0afdfa3da79df
google.golang.org/grpc@v1.69.2
1.83.1
mcr.microsoft.com/oss/v2/kubernetes-csi/csi-resizer:v1.13.2fa8eba9843ff
google.golang.org/grpc@v1.69.2
1.83.1
mcr.microsoft.com/oss/v2/nvidia/k8s-device-plugin:v0.18.2-125a4e52c87bb9
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

2,539
dockerdkarljorgensen0.1.01 of 1See more

dockerd karljorgensen 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
library/docker:28.5.2-dind2a232a42256f
google.golang.org/grpc@v1.72.2
1.83.1

Open the chart page →

2,055
k10restorekastenVerified publisher8.0.141 of 1See more

k10restore kasten 8.0.14

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gcr.io/kasten-images/restorectl:8.0.145a0884f9a90c
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

1,508
kbot-self-hostedkbot-self-hostedVerified publisher0.1.81 of 7See more

kbot-self-hosted kbot-self-hosted 0.1.8

1 of the 7 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gotenberg/gotenberg:8.30206a6c708fc6
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

33,242
kcmkcm1.12.04 of 12See more

kcm kcm 1.12.0

4 of the 12 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
velero/velero:v1.18.237396519f399
google.golang.org/grpc@v1.81.1
1.83.1
ghcr.io/fluxcd/flux-cli:v2.9.1020edbaee890
google.golang.org/grpc@v1.80.0
1.83.1
ghcr.io/fluxcd/helm-controller:v1.6.2e17ab0e5885d
google.golang.org/grpc@v1.80.0
1.83.1
ghcr.io/fluxcd/source-controller:v1.9.22b8d06650a1b
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

3,330
kcp-operatorkcp-devVerified publisher0.7.101 of 1See more

kcp-operator kcp-dev 0.7.10

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/kcp-dev/kcp-operator:v0.9.0cd8bf46d98e0
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

141

Container images carrying it

2,756 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
google.golang.org/grpc@v1.34.0
1.83.1
1
registry.k8s.io/sig-storage/livenessprobe:v2.9.02b10b24dafdc
google.golang.org/grpc@v1.49.0
1.83.1
1
registry.k8s.io/sig-storage/livenessprobe:v2.11.082adbebdf5d5
google.golang.org/grpc@v1.58.0
1.83.1
1
registry.k8s.io/sig-storage/nfsplugin:v4.13.41eb5a85180a4
google.golang.org/grpc@v1.79.3
1.83.1
1
registry.k8s.io/sig-storage/nfsplugin:v4.11.0ce5b5ccd5eb0
google.golang.org/grpc@v1.71.0
1.83.1
1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
google.golang.org/grpc@v1.74.2
1.83.1
1

syft 1.42.1 · advisories as of 20 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.