CVE-2024-40634 HIGH

CVE-2024-40634: Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint

Vendor Argoproj
Product argo-cd
Weakness CWE-400
Published July 22, 2024
Last update August 2, 2024
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.

Key dates

02Disclosure timeline

July 22, 2024 CVE published
August 2, 2024 Record updated