AZL-99150 CVE-2026-84304 affecting package azcopy for versions less than 10.25.1-9

🗓️ 01 Sep 2026 19:17:30Reported by GoogleType

osv🔗 osv.dev👁 8 Views

Memory exhaustion DoS in azcopy 10.25.1-7 via gRPC-Go fragmented HTTP/2 DATA frame handling.

Reporter	Title	Published	Views	Family All 1000
BDU FSTEC	The vulnerability in the `internal/transport/transport.go` file of the gRPC-Go framework for remote procedure calls in the Go programming language allows a attacker to cause a service failure.	4 Sep 202600:00	–	bdu_fstec
CBLMariner	CVE-2026-84304 affecting package azcopy for versions less than 10.25.1-9	19 Sep 202602:59	–	cbl_mariner
CBLMariner	CVE-2026-84304 affecting package azurelinux-image-tools for versions less than 1.6.0-3	19 Sep 202602:59	–	cbl_mariner
CBLMariner	CVE-2026-84304 affecting package containerized-data-importer for versions less than 1.62.0-8	19 Sep 202602:59	–	cbl_mariner
CBLMariner	CVE-2026-84304 affecting package coredns for versions less than 1.11.4-21	19 Sep 202602:59	–	cbl_mariner
CBLMariner	CVE-2026-84304 affecting package gh for versions less than 2.101.0-1	18 Sep 202614:58	–	cbl_mariner
CBLMariner	CVE-2026-84304 affecting package kata-containers for versions less than 3.32.0.kata0-6	19 Sep 202602:59	–	cbl_mariner
CBLMariner	CVE-2026-84304 affecting package kata-containers-cc for versions less than 3.15.0.aks0-21	19 Sep 202602:59	–	cbl_mariner
CBLMariner	CVE-2026-84304 affecting package multus for versions less than 4.0.2-11	19 Sep 202602:59	–	cbl_mariner
CBLMariner	CVE-2026-84304 affecting package skopeo for versions less than 1.14.4-13	19 Sep 202602:59	–	cbl_mariner

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-84304

23 Sep 2026 14:17Current

7.3High risk

Vulners AI Score7.3

CVSS 48.7

EPSS0.00609

SSVC

azcopy gRPC-Go memory exhaustion HTTP/2 fragmentation denial of service unauthenticated