Compound WireTHE STANDUP1 September 2026
gRPC-Go
1-BYTE FRAMES EXHAUST THE HEAP
gRPC-Go bug: tiny HTTP/2 data frames can OOM your server
CVE-2026-84304, high, in gRPC-Go: an unauthenticated caller can fragment a stream payload into millions of 1-byte HTTP/2 DATA frames and exhaust the heap. The advisory notes each fragment carries tracking overhead, so flow-control windows do not bound it. #dev