{"action":"Upgrade github.com/kumahq/kuma to 2.0.8 or later.","affected":[{"fixed":"2.4.3","introduced":"2.4.0"},{"fixed":"2.3.3","introduced":"2.3.0"},{"fixed":"2.2.4","introduced":"2.2.0"},{"fixed":"2.1.8","introduced":"2.1.0"},{"fixed":"2.0.8","introduced":"0"}],"component":"github.com/kumahq/kuma","cve_ids":[],"ecosystem":"Go","exploited":false,"fixed_versions":["2.4.3","2.3.3","2.2.4","2.1.8","2.0.8"],"ghsa_id":"GHSA-9wmc-rg4h-28wv","id":"tcs_01M5KF6AK2TQ2VB6MNYAGQ0RQ3","modified_at":"2025-10-13T15:41:49Z","published_at":"2023-10-17T12:41:55Z","references":["https://osv.dev/vulnerability/GHSA-9wmc-rg4h-28wv","https://github.com/envoyproxy/envoy/security/advisories/GHSA-jhv4-f7mr-xx76","https://github.com/kumahq/kuma/security/advisories/GHSA-9wmc-rg4h-28wv","https://github.com/golang/go/issues/63417","https://github.com/kumahq/kuma/pull/8001","https://github.com/kumahq/kuma/pull/8023","https://github.com/kumahq/kuma/pull/8034","https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack","https://github.com/advisories/GHSA-qppj-fm5r-hxr3","https://github.com/kumahq/kuma","https://www.envoyproxy.io/docs/envoy/latest/configuration/best_practices/edge","https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products/?sf269548684=1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-9wmc-rg4h-28wv","url":"https://osv.dev/vulnerability/GHSA-9wmc-rg4h-28wv"}],"summary":"github.com/kumahq/kuma affected by CVE-2023-44487"}