VDB
RHSA-2026:79575
RHSA-2026:79575
PUBLISHED
CVSS 7.5 HIGH
A flaw was found in gRPC-Go. This vulnerability allows an unauthenticated remote attacker to exhaust process memory by sending millions of fragmented HTTP/2 DATA frames. Each fragmented frame is stored as a separate message, consuming disproportionate heap memory. This can lead to a runtime panic or out-of-memory termination, resulting in a Denial of Service (DoS).
Risk Scores
CVSS 3.1
7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:2dc54acb63dd6975d9e42e164e1a49517a54731ccc87509afac67bc184a9d08a_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:4e1f0cd1e8c87022075feaf237cba72ee7fb46d648064759ee8d99a62d878a50_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-operator-bundle@sha256:c928cec8449aa90f69b603236051e1720d2bd5bd24f20a57c8dec342e7abb4b4_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-v4-db-rhel9@sha256:3c99591dcbd9034c899dc0be7a47b4f299972c89624d7ed6ffccb11bc60bfefb_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-fact-rhel9@sha256:5910c53267e934bb61cd2116951022a9ae9df9f0a62d9362f900346aa85b832d_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-main-rhel9@sha256:51944d40d87d221c668fc2ada16ee8442f66ad36e5d15a2311a1ab7d10db1493_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:dc7378c0f901896b7b3fe521290c0face3bcf2fef01f7a58273e555ed8c7b6de_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-collector-rhel9@sha256:0e605e654f5413da0fb8ab16adc879f8e2eb016f66c4f5f023f3cacf6d6bb585_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:1d0592d8d44ae6ff500e7f6ac8561cb1506a9c86f3f4d040440f0a9395b7f683_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:dafbca418faf0151dbb80416fa5fec5a91582cfb4a4b364dfa2e100d15047e32_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9@sha256:70e66c0e6978ce4948cb05a9afe07b3bd011d841bc6d781ad014c12c52893b9d_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:04a8a4fa3564d72c7306efb86b5777424b036fda4dce11d41af34ae0610d1cc5_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:4a28fc213cd138f1e9bbbfe4c4ac38a14e2279371b6e3d03b702c7554c952433_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9@sha256:344494b6a0b6111d278a6ddbcd6715c49e9d659ee320149824e87db219c9e414_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-slim-rhel9@sha256:6966f3f7b26155bcda4b11e9dfba5b336f68a92da080665294a4e608b452d845_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-central-db-rhel9@sha256:ca2c680c80b26e8771708944cf164977a841f5c6a33876067c356d4eeab451ae_ppc64le as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-rhel9-operator@sha256:f1b6a26111699861172990f2a1b3bbaf84771ba3d83d33b5fc523178a9ce9e5b_s390x as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-db-rhel9@sha256:053c869d48dd00528034432098b28def714ac30d9a9079321b919370e3ce854d_amd64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-roxctl-rhel9@sha256:909ad0a3e56d5c696780693907ac43d6f641b544eca51d0695cb13d2edb7c0e5_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
| Red Hat | registry.redhat.io/advanced-cluster-security/rhacs-scanner-rhel9@sha256:f4680562e24e01b501000800c076db6cb4093988962954d3e0fe3ab1aafe9933_arm64 as a component of Red Hat Advanced Cluster Security for Kubernetes for IBM Z and LinuxONE 4.11 | * |
…and 27 more
Timeline
- Oct 8, 2026 CVE Published
- Oct 26, 2026 CVE Updated
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Distribution Patch
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
- Oct 26, 2026 Security Advisory
References
- https://access.redhat.com/errata/RHSA-2026:79575 advisory
- https://access.redhat.com/security/cve/CVE-2026-84304 advisory
- https://access.redhat.com/security/cve/CVE-2026-84445 advisory
- https://access.redhat.com/security/updates/classification/ advisory
- https://docs.redhat.com/en/documentation/red_hat_advanced_cluster_security_for_kubernetes/4.11/html-single/release_notes/index#about-this-release-4115_release-notes-411 advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_79575.json advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2526955 issue
- https://www.cve.org/CVERecord?id=CVE-2026-84304 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84304 advisory
- https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176 advisory
- https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77 advisory
- https://github.com/grpc/grpc-go/pull/9331 advisory
- https://github.com/grpc/grpc-go/pull/9333 advisory
- https://github.com/grpc/grpc-go/releases/tag/v1.83.1 advisory
- https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2533175 issue
- https://www.cve.org/CVERecord?id=CVE-2026-84445 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-84445 advisory
- https://github.com/grpc/grpc-go/commit/3822494d8ea03b992c089fd2a195f041762fffb7 advisory
- https://github.com/grpc/grpc-go/commit/8668b69c167df908b6b3666dcbf40992b9e932a4 advisory
…and 8 more