{"id":"CVE-2024-40634","published":"2024-07-22T17:22:55Z","modified":"2024-08-02T04:33:11Z","title":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint","vendor":"argoproj","product":"argo-cd","tier":"tail","description":{"text":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.\n","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01392,"percentile":0.72333,"provenance":"source"},"cwes":[{"id":"CWE-400","name":"Uncontrolled Resource Consumption"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3w","tags":["x_refsource_CONFIRM"]},{"url":"https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36","tags":["x_refsource_MISC"]},{"url":"https://github.com/argoproj/argo-cd/commit/d881ee78949e23160a0b280bb159e4d3d625a4df","tags":["x_refsource_MISC"]}],"priority":{"score":19.7,"factors":[{"name":"EPSS percentile","points":14.47},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"argoproj","affectedVersions":[{"vendor":"argoproj","product":"argo-cd","versions":[">= 1.0.0, < 2.9.20",">= 2.10.0, < 2.10.15",">= 2.11.0, < 2.11.6"]}],"affected":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","vulnerableRanges":[">=1.0.0, <=1.8.7",">=1.0.0"],"patched":[],"from":["GHSA-jmvp-698c-4x3w","GO-2024-3002"],"provenance":"source"},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","vulnerableRanges":["<2.9.20",">=2.10.0, <2.10.15",">=2.11.0, <2.11.6"],"patched":["2.9.20","2.10.15","2.11.6"],"from":["GHSA-jmvp-698c-4x3w","GO-2024-3002"],"provenance":"source"}],"euvd":{"id":"EUVD-2024-2379","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-argoproj-argo-cd-cve-2020-11576","parents":[{"from":"CVE-2023-40025","to":"CVE-2024-40634","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/server.go"],"commits":["https://github.com/argoproj/argo-cd/commit/e047efa8f9518c54d00d2e4493b64bc4dba98478","https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc","https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36"],"basis":"shared function","functions":["newHTTPServer"]}]},{"from":"CVE-2024-22424","to":"CVE-2024-40634","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/server.go"],"commits":["https://github.com/argoproj/argo-cd/commit/0b459f224b3186707809be8240dfc3a6028f42a0","https://github.com/argoproj/argo-cd/commit/13fe3ca589f6f2ded6001ce114e354602ed058b3","https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc","https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36"],"basis":"shared function","functions":["newHTTPServer"]}]},{"from":"CVE-2024-21661","to":"CVE-2024-40634","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["server/server.go"],"commits":["https://github.com/argoproj/argo-cd/commit/2a22e19e06aaf6a1e734443043310a66c234e345","https://github.com/argoproj/argo-cd/commit/5bbb51ab423f273dda74ab956469843d2db2e208","https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc","https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36"],"basis":"shared function","functions":["newHTTPServer"]}]}],"packageHistory":[{"cve":"CVE-2024-31989","published":"2024-05-21","fixed":"2.11.1","kev":false},{"cve":"CVE-2024-36106","published":"2024-06-06","fixed":"2.11.3","kev":false,"link":{"from":"CVE-2024-36106","to":"CVE-2024-40634","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.9.17","toFixed":"2.9.20","daysApart":46}]}},{"cve":"CVE-2024-37152","published":"2024-06-06","fixed":"2.11.3","kev":false},{"cve":"CVE-2024-40634","published":"2024-07-22","fixed":"2.11.6","kev":false},{"cve":"CVE-2024-41666","published":"2024-07-24","fixed":"2.11.7","kev":false,"link":{"from":"CVE-2024-40634","to":"CVE-2024-41666","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"Go:github.com/argoproj/argo-cd/v2","fromFixed":"2.9.20","toFixed":"2.9.21","daysApart":2}]}},{"cve":"CVE-2025-23216","published":"2025-01-30","fixed":"2.13.4","kev":false},{"cve":"CVE-2025-47933","published":"2025-05-29","fixed":"2.14.13","kev":false}],"package":"Go:github.com/argoproj/argo-cd/v2"}}