Skip to content
fr Sign in
7.5 High

CVE-2024-40634 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.

Affected products and versions

Product Affected versions Fixed in
argo-cd 2.11 2.11.0 → < 2.11.6 2.11.6
argo-cd 2.10 2.10.0 → < 2.10.15 2.10.15
argo-cd 1.0 1.0.0 → < 2.9.20 2.9.20

References

Timeline

  1. Published
  2. Last modified

Other CVEs of argo-cd

The 49 CVEs of argo-cd →
CVE-2026-113709 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critical CVE-2026-113708 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critical CVE-2026-113672 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critical CVE-2026-77459 Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes 9.9 Critical
Track this CVE