StackRadar

CVE-2026-84304

High

Advisory

Published 1 Sept 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
8.7
base score, highest
EPSS
0.004
35th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
2,280
of 17,828 indexed, latest versions
Container images
2,740
deployed by those charts
Fix available
1 of 2
affected packages

gRPC-Go: Heap Memory Exhaustion (OOM) via HTTP/2 DATA Frame Fragmentation

Carried by container images the latest versions of 2,280 of 17,828 indexed charts deploy, on 2,740 images.

Affected packageAffected versionsFixed inImages
google.golang.org/grpcgolangv0.0.0-20160317175043-d3ddb4469d5a, v0.0.0-20170216003643-d0c32ee6a441, v1.10.0, v1.14.0+115 more1.83.12,737
grpcdeb1.16.1-1ubuntu5, 1.51.1-4.1build5no fix listed3
OSV records
GHSA-vp52-pcj8-j9qcUBUNTU-CVE-2026-84304
Also known as
GO-2026-6348

Charts affected

2,280 by stars
ChartLatestAffected imagesRadar Score
uffizzi-appuffizzi-app1.3.03 of 14See more

uffizzi-app uffizzi-app 1.3.0

3 of the 14 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.13.29c67cf8c92d8
google.golang.org/grpc@v1.58.3
1.83.1
quay.io/jetstack/cert-manager-ctl:v1.13.24d9fce2c050e
google.golang.org/grpc@v1.58.3
1.83.1
quay.io/jetstack/cert-manager-webhook:v1.13.20a9470447ebf
google.golang.org/grpc@v1.58.3
1.83.1

Open the chart page →

19,390
valdvald1.8.04 of 5See more

vald vald 1.8.0

4 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
vdaas/vald-agent-ngt:v1.8.032e3695fe585
google.golang.org/grpc@v1.83.0
1.83.1
vdaas/vald-discoverer-k8s:v1.8.0f6495f38ae92
google.golang.org/grpc@v1.83.0
1.83.1
vdaas/vald-lb-gateway:v1.8.061009e319a9a
google.golang.org/grpc@v1.83.0
1.83.1
vdaas/vald-manager-index:v1.8.0ab881d2262d8
google.golang.org/grpc@v1.83.0
1.83.1

Open the chart page →

216
vault-operatorvault-operatorVerified publisher1.24.01 of 1See more

vault-operator vault-operator 1.24.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/bank-vaults/vault-operator:v1.24.06f622c5fb8a9
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

543
vault-secrets-webhookvault-secrets-webhookVerified publisher1.23.11 of 1See more

vault-secrets-webhook vault-secrets-webhook 1.23.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/bank-vaults/vault-secrets-webhook:v1.23.198baf045a1c9
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

529
athens-proxyvolker-raschekVerified publisher2.0.31 of 1See more

athens-proxy volker-raschek 2.0.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gomods/athens:v0.17.10f61d1e62359
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

2,047
dexwiremindVerified publisher2.15.71 of 2See more

dex wiremind 2.15.7

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/dexidp/dex:v2.24.0c9b7f6d0d953
google.golang.org/grpc@v1.26.0
1.83.1

Open the chart page →

13,600
yunikornyunikornVerified publisher1.9.02 of 3See more

yunikorn yunikorn 1.9.0

2 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
apache/yunikorn:scheduler-1.9.096832082e9cf
google.golang.org/grpc@v1.79.3
1.83.1
apache/yunikorn:admission-1.9.0fe8f5ec91f6c
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

412
aperture-controlleraperture2.34.02 of 5See more

aperture-controller aperture 2.34.0

2 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
fluxninja/aperture-operator:2.34.0356d7aa86632
google.golang.org/grpc@v1.60.1
1.83.1
quay.io/prometheus/prometheus:v2.33.591100b06e86d
google.golang.org/grpc@v1.43.0
1.83.1

Open the chart page →

4,681
k8upappuio2.0.51 of 1See more

k8up appuio 2.0.5

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/k8up-io/k8up:v2.3.257419b6d3830
google.golang.org/grpc@v1.38.0
1.83.1

Open the chart page →

3,309
athens-proxyathens-chartsOfficialVerified publisher0.17.11 of 1See more

athens-proxy athens-charts 0.17.1

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gomods/athens:v0.18.197cc113b34b0
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

1,307
openshift-consoleav1o-chartsVerified publisher0.3.61 of 1See more

openshift-console av1o-charts 0.3.6

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/openshift/origin-console:4.10.00bbe8b451fa3
google.golang.org/grpc@v1.38.0
1.83.1

Open the chart page →

9,067
prometheusaveshaVerified publisher19.3.01 of 4See more

prometheus avesha 19.3.0

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/prometheus/prometheus:v2.41.01a3e9a878e50
google.golang.org/grpc@v1.51.0
1.83.1

Open the chart page →

5,505
snapschedulerbackube-helm-chartsVerified publisher3.5.01 of 2See more

snapscheduler backube-helm-charts 3.5.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/brancz/kube-rbac-proxy:v0.19.19f21034731c7
google.golang.org/grpc@v1.65.0
1.83.1

Open the chart page →

1,240
boundaryboundaryVerified publisher0.1.01 of 1See more

boundary boundary 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hashicorp/boundary:0.21.037bf86488b74
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

1,591
caddy-ingress-controllercaddy-ingress1.3.01 of 1See more

caddy-ingress-controller caddy-ingress 1.3.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
caddy/ingress:v0.2.118d1366fc0e9
google.golang.org/grpc@v1.59.0
1.83.1

Open the chart page →

1,901
cadvisorcadvisorVerified publisher0.1.151 of 1See more

cadvisor cadvisor 0.1.15

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gcr.io/cadvisor/cadvisor:v0.47.2e6c562b5e983
google.golang.org/grpc@v1.51.0
1.83.1

Open the chart page →

1,705
cert-managerchoerodon1.8.23 of 4See more

cert-manager choerodon 1.8.2

3 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/jetstack/cert-manager-controller:v1.8.2a20c44021a5d
google.golang.org/grpc@v1.43.0
1.83.1
quay.io/jetstack/cert-manager-ctl:v1.8.281b2d775edad
google.golang.org/grpc@v1.43.0
1.83.1
quay.io/jetstack/cert-manager-webhook:v1.8.2ada7edd90bec
google.golang.org/grpc@v1.43.0
1.83.1

Open the chart page →

7,801
cloudprobercloudproberOfficialVerified publisher1.14.251 of 1See more

cloudprober cloudprober 1.14.25

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/cloudprober/cloudprober:v0.14.540c6d960ae4f
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

221
dumpscriptcloudscriptVerified publisher1.8.31 of 1See more

dumpscript cloudscript 1.8.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/cloudscript-technology/dumpscript:v0.0.42-alpine-edgefce5b6fd161c
google.golang.org/grpc@v1.76.0
1.83.1

Open the chart page →

2,130
cluster-manager-servercluster-manager-server1.8.01 of 1See more

cluster-manager-server cluster-manager-server 1.8.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/cluster-manager-server:1.8.0364b3ff0fcb7
google.golang.org/grpc@v1.68.1
1.83.1

Open the chart page →

753
coder-observabilitycoder-observabilityVerified publisher0.7.37 of 21See more

coder-observability coder-observability 0.7.3

7 of the 21 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/agent:v0.40.3f6cbec9409be
google.golang.org/grpc@v1.61.0
1.83.1
grafana/grafana:10.4.19a9043254ba16
google.golang.org/grpc@v1.71.0
1.83.1
grafana/loki:3.1.0d947e68a84d9
google.golang.org/grpc@v1.62.1
1.83.1
grafana/loki-canary:3.1.039baf6d67f85
google.golang.org/grpc@v1.62.1
1.83.1
quay.io/minio/mc:RELEASE.2022-09-16T09-16-47Z546a8b52d7b0
google.golang.org/grpc@v1.44.0
1.83.1
quay.io/minio/minio:RELEASE.2022-09-17T00-09-45Zc3d20bc2ea08
google.golang.org/grpc@v1.49.0
1.83.1
quay.io/prometheus/prometheus:v2.53.1f20d3127bf28
google.golang.org/grpc@v1.64.0
1.83.1

Open the chart page →

24,973
convertigoconvertigoOfficialVerified publisher8.4.31 of 5See more

convertigo convertigo 8.4.3

1 of the 5 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
baserow/baserow:1.30.1df0c42eb67e8
google.golang.org/grpc@v1.59.0
1.83.1

Open the chart page →

17,018
core-dump-handlercore-dump-handler9.0.01 of 1See more

core-dump-handler core-dump-handler 9.0.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/icdh/core-dump-handler:v9.0.0cc79b9e2a1c8
google.golang.org/grpc@v1.39.0
1.83.1

Open the chart page →

3,089
cosmocosmo-platformOfficialVerified publisher0.20.02 of 10See more

cosmo cosmo-platform 0.20.0

2 of the 10 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
bitnamilegacy/minio:2025.7.23-debian-12-r56dabb4a2088c
google.golang.org/grpc@v1.71.0
1.83.1
ghcr.io/wundergraph/cosmo/otelcollector:0.18.15a6fe78d4d15
google.golang.org/grpc@v1.64.0
1.83.1

Open the chart page →

29,756
ocularcrashoverride-helm-chartsVerified publisher0.5.21 of 1See more

ocular crashoverride-helm-charts 0.5.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/crashappsec/ocular-controller:v0.4.122060cf61e0e
google.golang.org/grpc@v1.83.0
1.83.1

Open the chart page →

37
dapr-dashboarddapr0.15.01 of 1See more

dapr-dashboard dapr 0.15.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
daprio/dashboard:0.15.04be696707bd1
google.golang.org/grpc@v1.61.0
1.83.1

Open the chart page →

1,322
deepflowdeepflow6.2.2013 of 8See more

deepflow deepflow 6.2.201

3 of the 8 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
deepflowce/deepflow-init-grafana:v6.2.27cd16719eb57
google.golang.org/grpc@v1.47.0
1.83.1
deepflowce/deepflow-server:v6.2.21477e7334d13
google.golang.org/grpc@v1.49.0
1.83.1
grafana/grafana:9.3.6e5a9655dabef
google.golang.org/grpc@v1.45.0
1.83.1

Open the chart page →

16,009
hoppscotchdeliveryheroVerified publisher0.3.21 of 1See more

hoppscotch deliveryhero 0.3.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hoppscotch/hoppscotch:2024.8.2f1da831950b7
google.golang.org/grpc@v1.59.0
1.83.1

Open the chart page →

3,482
distrdistrOfficialVerified publisher4.0.31 of 4See more

distr distr 4.0.3

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
grafana/loki:3.7.7d70e4659623f
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

410
bscdysnixVerified publisher0.6.591 of 4See more

bsc dysnix 0.6.59

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/bnb-chain/bsc:1.6.2fd0e3ec7d960
google.golang.org/grpc@v1.69.4
1.83.1

Open the chart page →

1,905
element-callelement-callVerified publisher0.1.441 of 2See more

element-call element-call 0.1.44

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/element-hq/lk-jwt-service:0.6.0822f0c03a3bd
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

163
openshift-secured-appeximiaitVerified publisher0.5.01 of 1See more

openshift-secured-app eximiait 0.5.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/openshift/origin-oauth-proxy:4.14a7dff785d821
google.golang.org/grpc@v1.51.0
1.83.1

Open the chart page →

12,064
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/openshift/origin-oauth-proxy:4.14a7dff785d821
google.golang.org/grpc@v1.51.0
1.83.1

Open the chart page →

14,568
openshift-secured-redisInsighteximiaitVerified publisher0.9.21 of 2See more

openshift-secured-redisInsight eximiait 0.9.2

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/openshift/origin-oauth-proxy:4.14a7dff785d821
google.golang.org/grpc@v1.51.0
1.83.1

Open the chart page →

13,897
frp-operatorfrpVerified publisher1.0.41 of 1See more

frp-operator frp 1.0.4

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/aureum-cloud/frp-operator:v1.0.196b01d7e7025
google.golang.org/grpc@v1.68.1
1.83.1

Open the chart page →

382
frp-operatorfrp-operator1.9.01 of 1See more

frp-operator frp-operator 1.9.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/zufardhiyaulhaq/frp-operator:v0.11.0cd25ee354df2
google.golang.org/grpc@v1.58.3
1.83.1

Open the chart page →

542
intel-gpu-plugingeek-cookbookVerified publisher4.4.21 of 1See more

intel-gpu-plugin geek-cookbook 4.4.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
intel/intel-gpu-plugin:0.20.0143f0a45e174
google.golang.org/grpc@v1.27.1
1.83.1

Open the chart page →

1,746
mealiegeek-cookbookVerified publisher5.1.21 of 2See more

mealie geek-cookbook 5.1.2

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hkotel/mealie:frontend-v1.0.0beta-23c04c0e85039
google.golang.org/grpc@v1.39.0
1.83.1

Open the chart page →

7,637
multusgeek-cookbookVerified publisher3.5.21 of 3See more

multus geek-cookbook 3.5.2

1 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
ghcr.io/k8snetworkplumbingwg/multus-cni:v3.7.1e72aa733faf2
google.golang.org/grpc@v1.23.0
1.83.1

Open the chart page →

4,768
smarter-device-managergeek-cookbookVerified publisher6.5.21 of 1See more

smarter-device-manager geek-cookbook 6.5.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
registry.gitlab.com/arm-research/smarter/smarter-device-manager:v1.20.7864fc338571e
google.golang.org/grpc@v1.37.1
1.83.1

Open the chart page →

2,338
statpinggeek-cookbookVerified publisher6.2.01 of 2See more

statping geek-cookbook 6.2.0

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
statping/statping:v0.90.74e874da513a5c
google.golang.org/grpc@v1.28.1
1.83.1

Open the chart page →

3,379
gitlab-runnergitlab-jh0.93.01 of 1See more

gitlab-runner gitlab-jh 0.93.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
registry.gitlab.com/gitlab-org/gitlab-runner:alpine-v19.4.0a4838319e55b
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

280
etcdgroundhog2k1.1.121 of 2See more

etcd groundhog2k 1.1.12

1 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/coreos/etcd:v3.7.13c66a5191d37
google.golang.org/grpc@v1.82.1
1.83.1

Open the chart page →

143
giteagroundhog2k0.16.31 of 1See more

gitea groundhog2k 0.16.3

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
gitea/gitea:1.27.387a67ee09d3a
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

543
haproxyhaproxytechVerified publisher1.30.21 of 1See more

haproxy haproxytech 1.30.2

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
haproxytech/haproxy-alpine:3.4.41fe3f201ebb5
google.golang.org/grpc@v1.83.0
1.83.1

Open the chart page →

584
hcloud-cloud-controller-managerhcloud1.37.01 of 1See more

hcloud-cloud-controller-manager hcloud 1.37.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
hetznercloud/hcloud-cloud-controller-manager:v1.37.0c139e7220dbc
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

262
headscaleheadscaleVerified publisher1.0.193 of 3See more

headscale headscale 1.0.19

3 of the 3 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
alpine/k8s:1.36.244ef4942e171
google.golang.org/grpc@v1.77.0
1.83.1
ghcr.io/juanfont/headscale:0.29.30e7f1c6e4ce6
google.golang.org/grpc@v1.81.1
1.83.1
ghcr.io/juanfont/headscale:0.29.3-debug842cd94b754b
google.golang.org/grpc@v1.81.1
1.83.1

Open the chart page →

3,411
netbirdhelmforgeVerified publisher1.0.101 of 4See more

netbird helmforge 1.0.10

1 of the 4 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
netbirdio/netbird-server:0.78.13086534361a1
google.golang.org/grpc@v1.80.0
1.83.1

Open the chart page →

3,029
hpe-cosi-driverhpe-storageVerified publisher2.0.02 of 2See more

hpe-cosi-driver hpe-storage 2.0.0

2 of the 2 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
quay.io/hpestorage/cosi-driver:v2.0.0a4d2667f2b6e
google.golang.org/grpc@v1.79.3
1.83.1
registry.k8s.io/sig-storage/objectstorage-sidecar:v0.2.2c7166a73a303
google.golang.org/grpc@v1.74.2
1.83.1

Open the chart page →

1,696
inference-manager-engineinference-manager-engine1.46.01 of 1See more

inference-manager-engine inference-manager-engine 1.46.0

1 of the 1 container images this version deploys carry CVE-2026-84304.

Container imageDigestPackageFixed in
public.ecr.aws/cloudnatix/llmariner/inference-manager-engine:1.46.0c46f109c3d0b
google.golang.org/grpc@v1.79.3
1.83.1

Open the chart page →

266

Container images carrying it

2,740 by charts deploying them

A fixed version is listed for 1 of the 2 affected packages.

No deployed image carries CVE-2026-84304.

syft 1.42.1 · advisories as of 21 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.