CVE-2022-31054
Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
- Record
CVE-2022-31054- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2022-5946
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
- Record
EUVD-2022-5946- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5q86-62xr-3r57
Uses of deprecated API can be used to cause DoS in user-facing endpoints
Impact
Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service.
Eventsources susceptible to an out-of-memory denial-of-service attack:
- AWS SNS
- Bitbucket
- Bitbucket
- Gitlab
- Slack
- Storagegrid
- Webhook
Patches
A patch for this vulnerability has been released in the following Argo Events version:
v1.7.1
Credits
Disclosed by Ada Logics in a security audit sponsored by CNCF and facilitated by OSTIF.
For more information
Open an issue in the Argo Events issue tracker or discussions Join us on Slack in channel #argo-events
- Record
GHSA-5q86-62xr-3r57- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-787
- Updated
- 2026-11-02
NVD
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
- Record
CVE-2022-31054- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-400, CWE-787
- Updated
- 2026-11-02
OSV
Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
- Record
CVE-2022-31054- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-5q86-62xr-3r57
Uses of deprecated API can be used to cause DoS in user-facing endpoints
Impact
Several HandleRoute endpoints make use of the deprecated ioutil.ReadAll(). ioutil.ReadAll() reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service.
Eventsources susceptible to an out-of-memory denial-of-service attack:
- AWS SNS
- Bitbucket
- Bitbucket
- Gitlab
- Slack
- Storagegrid
- Webhook
Patches
A patch for this vulnerability has been released in the following Argo Events version:
v1.7.1
Credits
Disclosed by Ada Logics in a security audit sponsored by CNCF and facilitated by OSTIF.
For more information
Open an issue in the Argo Events issue tracker or discussions Join us on Slack in channel #argo-events
- Record
GHSA-5q86-62xr-3r57- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400, CWE-787
- Updated
- 2026-11-02
OSVGO-2022-0490 No score
Uses of deprecated API can be used to cause DoS in user-facing endpoints in github.com/argoproj/argo-events
Uses of deprecated API can be used to cause DoS in user-facing endpoints in github.com/argoproj/argo-events
- Record
GO-2022-0490- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/argoproj/argo-eventsGo |
before 1.7.1 | 1.7.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-31054 is a high vulnerability (CVSS 7.5) in Argo Events Project Events, published June 13, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.63%, the 76th percentile. Fixed in github.com/argoproj/argo-events 1.7.1.
References
github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57
nvd.nist.gov/vuln/detail/CVE-2022-31054