{"id":"GHSA-9wmc-rg4h-28wv","aliases":[],"status":"published","title":"github.com/kumahq/kuma affected by CVE-2023-44487","description":"### Impact\nEnvoy and Go HTTP/2 protocol stack is vulnerable to the \"Rapid Reset\" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames.\n\nThis can be exercised if you use the builtin gateway and receive untrusted http2 traffic.\n\n### Patches\n\nhttps://github.com/kumahq/kuma/pull/8023\nhttps://github.com/kumahq/kuma/pull/8001\nhttps://github.com/kumahq/kuma/pull/8034\n\n### Workarounds\nDisable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate.\n\n### References\nhttps://github.com/advisories/GHSA-qppj-fm5r-hxr3\nhttps://github.com/golang/go/issues/63417\nhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76\nhttps://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack\nhttps://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1\nhttps://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2023-10-17T12:41:55Z","modified":"2025-10-13T15:41:49Z","fixes":[{"ecosystem":"Go","package":"github.com/kumahq/kuma","fixed_in":["2.4.3","2.3.3","2.2.4","2.1.8","2.0.8"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.3"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.4"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"2.3.0"},{"fixed":"2.3.3"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.4"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"2.1.0"},{"fixed":"2.1.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/kumahq/kuma","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.0.8"}]}]}],"references":[{"url":"https://github.com/kumahq/kuma/security/advisories/GHSA-9wmc-rg4h-28wv","tags":["web"]},{"url":"https://github.com/kumahq/kuma/pull/8001","tags":["web"]},{"url":"https://github.com/kumahq/kuma/pull/8023","tags":["web"]},{"url":"https://github.com/kumahq/kuma/pull/8034","tags":["web"]},{"url":"https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76","tags":["web"]},{"url":"https://github.com/golang/go/issues/63417","tags":["web"]},{"url":"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qppj-fm5r-hxr3","tags":["advisory"]},{"url":"https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge","tags":["web"]},{"url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9wmc-rg4h-28wv"},{"url":"https://github.com/kumahq/kuma","tags":["package"]}],"sources":{"ghsa":[{"id":"GHSA-9wmc-rg4h-28wv","title":"github.com/kumahq/kuma affected by CVE-2023-44487","description":"### Impact\nEnvoy and Go HTTP/2 protocol stack is vulnerable to the \"Rapid Reset\" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames.\n\nThis can be exercised if you use the builtin gateway and receive untrusted http2 traffic.\n\n### Patches\n\nhttps://github.com/kumahq/kuma/pull/8023\nhttps://github.com/kumahq/kuma/pull/8001\nhttps://github.com/kumahq/kuma/pull/8034\n\n### Workarounds\nDisable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate.\n\n### References\nhttps://github.com/advisories/GHSA-qppj-fm5r-hxr3\nhttps://github.com/golang/go/issues/63417\nhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76\nhttps://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack\nhttps://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1\nhttps://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge","status":"published","published":"2023-10-17T12:41:55Z","modified":"2023-10-19T20:12:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T14:37:08.847568Z"}],"osv":[{"id":"GHSA-9wmc-rg4h-28wv","title":"github.com/kumahq/kuma affected by CVE-2023-44487","description":"### Impact\nEnvoy and Go HTTP/2 protocol stack is vulnerable to the \"Rapid Reset\" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames.\n\nThis can be exercised if you use the builtin gateway and receive untrusted http2 traffic.\n\n### Patches\n\nhttps://github.com/kumahq/kuma/pull/8023\nhttps://github.com/kumahq/kuma/pull/8001\nhttps://github.com/kumahq/kuma/pull/8034\n\n### Workarounds\nDisable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate.\n\n### References\nhttps://github.com/advisories/GHSA-qppj-fm5r-hxr3\nhttps://github.com/golang/go/issues/63417\nhttps://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76\nhttps://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack\nhttps://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1\nhttps://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge","status":"published","published":"2023-10-17T12:41:55Z","modified":"2025-10-13T15:41:49Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}