grpc: Heap Memory Exhaustion via Fragmented HTTP/2 DATA Frames

A remote peer can open a gRPC stream and split its payload across millions of tiny HTTP/2 DATA frames. Every fragment carries its own tracking structures and queue allocation, so the heap a stream consumes grows far beyond the negotiated connection and stream flow-control windows. Multiplexing several such streams exhausts the Go runtime’s memory and forces an out-of-memory condition, a remote denial of service. The fix compacts the receive buffer by coalescing consecutive small buffers from a shared pool, and is enabled by default in grpc-go 1.83.1.