7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

GHSA-9wmc-rg4h-28wv

GHSA-9wmc-rg4h-28wv: github.com/kumahq/kuma affected by CVE-2023-44487

Impact

Envoy and Go HTTP/2 protocol stack is vulnerable to the "Rapid Reset" class of exploits, which send a sequence of HEADERS frames optionally followed by RST_STREAM frames.

This can be exercised if you use the builtin gateway and receive untrusted http2 traffic.

Patches

https://github.com/kumahq/kuma/pull/8023 https://github.com/kumahq/kuma/pull/8001 https://github.com/kumahq/kuma/pull/8034

Workarounds

Disable http2 on the gateway listener with a MeshProxyPatch or ProxyTemplate.

References

https://github.com/advisories/GHSA-qppj-fm5r-hxr3 https://github.com/golang/go/issues/63417 https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76 https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1 https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge

(GitHub Advisory)

Miggo Vulnerability Database

→

GHSA-9wmc-rg4h-28wv

GHSA-9wmc-rg4h-28wv:

7.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kumahq/kuma	go	>= 2.4.0, < 2.4.3	2.4.3
github.com/kumahq/kuma	go	>= 2.3.0, < 2.3.3	2.3.3
github.com/kumahq/kuma	go	>= 2.2.0, < 2.2.4	2.2.4
github.com/kumahq/kuma	go	>= 2.1.0, < 2.1.8	2.1.8
github.com/kumahq/kuma	go	< 2.0.8	2.0.8

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2023-44487 stems from the HTTP/2 protocol implementation in dependencies (Envoy and Go's HTTP/2 stack), not directly from functions in Kuma's codebase. The patches for Kuma (PRs #8001, #8023, #8034) involve updating these dependencies to fixed versions (Go 1.21.3, Envoy 1.27.1, golang.org/x/net v0.17.0, grpc 1.58.3). The vulnerability arises from how these underlying libraries handle HTTP/2 HEADERS + RST_STREAM frames, not from Kuma-specific logic. No Kuma-owned functions are explicitly identified as vulnerable in the provided data. The exploit occurs at the HTTP/2 protocol layer in Envoy/Go, which Kuma uses but does not directly implement.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.