CVE-2022-31016

    Dashboard / Vulnerabilities / CVE-2022-31016

    CVE-2022-31016

    Published: 25 Jun 2022Last Modified: 12 Aug 2026

    Summary: Argo CD vulnerable to Uncontrolled Memory Consumption

    Details: Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.

    References: https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31016.json, https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq, https://nvd.nist.gov/vuln/detail/CVE-2022-31016

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6fc345f555dff62d232fe03bf17b8bf84d7f1b5d
    Fixed -903db5fe464032bd5a10bf32fe17639e76634c2a

    Affected versions

    v2.1.15
    v2.1.14
    v2.1.13
    v2.1.12
    v2.1.11
    v2.1.10
    v2.1.9
    v2.1.8
    v2.1.7
    v2.1.2
    v2.1.6
    v2.1.5
    v2.1.4
    v2.1.3
    v2.1.1
    v2.1.0
    v2.1.0-rc3
    v2.1.0-rc2
    v2.1.0-rc1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2022-31016 | CVE-DB