gRPC-Go, the Go implementation of gRPC, has a flaw that causes excessive heap usage when the library receives many fragmented HTTP/2 DATA frames. Each one‑byte frame is stored separately, so a victim can be forced to allocate memory far beyond what the payload actually requires. This can trigger a runtime panic or cause the process to terminate because it runs out of memory, leading to a denial of service. The weakness corresponds to CWE-400, a resource exhaustion problem.

The vulnerability affects the grpc-go library before version 1.83.1. Applications that use grpc-go 1.82 and earlier are susceptible, regardless of the Go runtime version. Any Go project that imports github.com/grpc/grpc-go and communicates over gRPC without a patched version of the library can be impacted.

The CVSS score of 8.7 indicates a high severity, and the EPSS score is not available, so the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Attackers only need to send many fragmented DATA frames over an HTTP/2 connection; an unauthenticated remote attacker can generate this traffic. Because the flaw is triggered by normal gRPC traffic and requires no special privileges, the threat is significant for services exposed to untrusted networks.