https://vulnerability.circl.lu/sightings/feed 2026-10-01T22:33:26.292588+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/1693d0db-3f8e-4e80-bead-9a2701ea3018/export 2026-10-01T22:33:26.324308+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "1693d0db-3f8e-4e80-bead-9a2701ea3018", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5tfgv2c", "content": "CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-81870 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-redis. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600", "creation_timestamp": "2026-09-25T05:40:17.754688Z"} 2026-09-25T05:40:17.754688+00:00 https://vulnerability.circl.lu/sighting/d8c8be13-6e94-44ca-b7da-25cf679365b1/export 2026-10-01T22:33:26.327819+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "d8c8be13-6e94-44ca-b7da-25cf679365b1", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n5ayqy2l", "content": "CVE-2026-81870 CVE-2026-81871 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security fixes for apigee-operators. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860", "creation_timestamp": "2026-09-25T05:40:15.027503Z"} 2026-09-25T05:40:15.027503+00:00 https://vulnerability.circl.lu/sighting/3c52a4cf-23bf-4d2f-a9d5-5578cda2542f/export 2026-10-01T22:33:26.328159+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "3c52a4cf-23bf-4d2f-a9d5-5578cda2542f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mwd2n46bgi2l", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security", "creation_timestamp": "2026-09-25T05:40:10.257860Z"} 2026-09-25T05:40:10.257860+00:00 https://vulnerability.circl.lu/sighting/2a1619a1-d319-4f99-bbf3-1cde7ebbe452/export 2026-10-01T22:33:26.328338+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "2a1619a1-d319-4f99-bbf3-1cde7ebbe452", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6r7w372b", "content": "CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf Forward proxy support for AI policies Apigee hybrid v1.16.10 adds forward proxy support for AI policies, such as the Model Armor and semantic caching policies. Outbound calls from these policies can now be", "creation_timestamp": "2026-09-20T05:20:20.059376Z"} 2026-09-20T05:20:20.059376+00:00 https://vulnerability.circl.lu/sighting/e0a894a1-5664-4546-995d-0726229d41b4/export 2026-10-01T22:33:26.328455+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e0a894a1-5664-4546-995d-0726229d41b4", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6qdsad22", "content": "Security fixes for apigee-prom-prometheus. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-84303 CVE-2026-84304", "creation_timestamp": "2026-09-20T05:20:15.469830Z"} 2026-09-20T05:20:15.469830+00:00 https://vulnerability.circl.lu/sighting/67b0acd0-2fa6-400a-8ec4-d66b88a890bb/export 2026-10-01T22:33:26.328569+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "67b0acd0-2fa6-400a-8ec4-d66b88a890bb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6q6hc72e", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf GHSA-w67g-5rqw-f597 N/A", "creation_timestamp": "2026-09-20T05:20:14.359418Z"} 2026-09-20T05:20:14.359418+00:00 https://vulnerability.circl.lu/sighting/e2819053-56b7-44e4-bb16-154372646edb/export 2026-10-01T22:33:26.328685+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e2819053-56b7-44e4-bb16-154372646edb", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6pfjye2s", "content": "fixes for apigee-fluent-bit. This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445", "creation_timestamp": "2026-09-20T05:20:10.629265Z"} 2026-09-20T05:20:10.629265+00:00 https://vulnerability.circl.lu/sighting/e1eacc7e-5ad1-4595-8002-3b31822eb381/export 2026-10-01T22:33:26.328792+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "e1eacc7e-5ad1-4595-8002-3b31822eb381", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://bsky.app/profile/gcpweekly.bsky.social/post/3mvwh6p7ulh2c", "content": "This addresses the following vulnerabilities: CVE-2026-33818 CVE-2026-39821 CVE-2026-46600 CVE-2026-56853 CVE-2026-56858 CVE-2026-56859 CVE-2026-56860 CVE-2026-56862 CVE-2026-56864 CVE-2026-56865 CVE-2026-84303 CVE-2026-84304 CVE-2026-84445 GHSA-hrxh-6v49-42gf N/A Security", "creation_timestamp": "2026-09-20T05:20:08.890212Z"} 2026-09-20T05:20:08.890212+00:00 https://vulnerability.circl.lu/sighting/fa6087ad-4b31-4ae3-8e8e-6af18ec3ea51/export 2026-10-01T22:33:26.328889+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "fa6087ad-4b31-4ae3-8e8e-6af18ec3ea51", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://infosec.exchange/users/vuldb/statuses/117201768874255726", "content": "Our CTI team identified a lot of activities targeting gRPC-Go (CVE-2026-84304) https://vuldb.com/vuln/397800/cti", "creation_timestamp": "2026-09-02T13:51:09.484325Z"} 2026-09-02T13:51:09.484325+00:00 https://vulnerability.circl.lu/sighting/6dda4458-23cd-4866-a778-d214733b1ad7/export 2026-10-01T22:33:26.328985+00:00 Automation user https://cvepremium.circl.lu/user/automation {"uuid": "6dda4458-23cd-4866-a778-d214733b1ad7", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-84304", "type": "seen", "source": "https://gist.github.com/alon710/422f915c96f67cc1c9fceb7d3c2778a9", "content": "# CVE-2026-84304: CVE-2026-84304: Uncontrolled Resource Consumption in gRPC-Go HTTP/2 Frame Processing\n\n> **CVSS Score:** 8.7\n> **Published:** 2026-09-01\n> **Full Report:** https://cvereports.com/reports/CVE-2026-84304\n\n## Summary\nCVE-2026-84304 is a high-severity uncontrolled resource consumption vulnerability in gRPC-Go, the Go implementation of the gRPC framework. The issue stems from a memory amplification flaw inside the HTTP/2 DATA frame processing subsystem. Remote, unauthenticated attackers can exploit this vulnerability by sending a high volume of heavily fragmented, tiny DATA frames within multiplexed concurrent streams. This causes gRPC-Go servers to allocate excessive internal metadata structures on the Go heap, leading to severe heap memory amplification, intense garbage collection thrashing, and process termination due to Out-of-Memory (OOM) conditions.\n\n## TL;DR\nAn unauthenticated remote attacker can crash gRPC-Go servers (prior to version 1.83.1) by sending millions of fragmented, 1-byte HTTP/2 DATA frames. This bypasses standard flow control limits, forcing excessive metadata allocation on the heap and leading to Out-of-Memory (OOM) crashes.\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network (AV:N)\n- **CVSS v4.0 Score**: 8.7\n- **Vulnerability Type**: Uncontrolled Resource Consumption\n- **Exploit Status**: none\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- gRPC-Go applications utilizing transport layers prior to version 1.83.1.\n- **gRPC-Go**: < 1.83.1 (Fixed in: `1.83.1`)\n\n## Mitigation\n\n- Upgrade gRPC-Go library dependencies to version 1.83.1 or later.\n- Enforce minimum HTTP/2 frame size limits via an edge proxy or WAF.\n- Limit concurrent HTTP/2 streams per connection using gRPC server configuration parameters.\n- Do not set GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION to false in production environments.\n\n**Remediation Steps:**\n1. Open the project's go.mod file and locate the google.golang.org/grpc dependency.\n2. Run the command: go get google.golang.org/grpc@v1.83.1.\n3. Execute go mod tidy to update the dependency tree and verify the checksums in go.sum.\n4. Recompile all dependent application binaries and redeploy the updated services into production.\n5. Verify that the environment variable GRPC_GO_EXPERIMENTAL_ENABLE_RECEIVE_BUFFER_COMPACTION is not disabled in the deployment templates.\n\n## References\n\n- [GitHub Security Advisory GHSA-vp52-pcj8-j9qc](https://github.com/grpc/grpc-go/security/advisories/GHSA-vp52-pcj8-j9qc)\n- [Fix Commit - Buffer Compaction Implementation](https://github.com/grpc/grpc-go/commit/7354d9c8debb4bcf2225bf429857078de310c176)\n- [Cherry-pick Commit to v1.83.x Release Branch](https://github.com/grpc/grpc-go/commit/8cfeca0e1ee5ea0980dcc320e20240fa1079ec77)\n- [gRPC-Go Pull Request #9331](https://github.com/grpc/grpc-go/pull/9331)\n- [gRPC-Go Pull Request #9333](https://github.com/grpc/grpc-go/pull/9333)\n- [gRPC-Go Release v1.83.1 Tag](https://github.com/grpc/grpc-go/releases/tag/v1.83.1)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-84304) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-01T22:31:39.110414Z"} 2026-09-01T22:31:39.110414+00:00