CVE Feed

    Dashboard / CVE / CVE-2024-40634

    CVE-2024-40634

    Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.

    Published:Jul 22, 2024
    Last Modified:Jan 9, 2025
    EPS:Jul 22, 2024
    EPSS Score:0.02344
    CVSS Score:7.5

    Affected Products

    Vendor
    Argoproj
    Product
    Argo-cd
    Vendor
    Argoproj
    Product
    Argo Cd
    Vendor
    Redhat
    Product
    Openshift Gitops

    Exploits

    https://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3whttps://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3w

    Related CVEs

    CVE-2026-45737 (CVSS 6.3) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and…
    CVE-2026-45738 (CVSS 7.3) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, …
    CVE-2026-42880 (CVSS 9.6) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From versions 3.2.0 to before 3.2.11…
    CVE-2026-43824 (CVSS 7.7) — In Argo CD 3.2.0 before 3.2.11 and 3.3.0 before 3.3.9, ServerSideDiff allows reading cleartext Kubernetes Secr…
    CVE-2025-59538 (CVSS 7.5) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.…
    CVE-2025-59537 (CVSS 7.5) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-…
    CVE-2025-59531 (CVSS 7.5) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-…
    CVE-2025-55191 (CVSS 6.5) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions between 2.1.0 and 2.14.19, …
    CVE-2025-55190 (CVSS 9.9) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. In versions 2.13.0 through 2.13.8, 2…
    CVE-2024-31989 (CVSS 9) — Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. It has been discovered that an unpri…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High