CVE-2024-29893
Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
- Record
CVE-2024-29893- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
EUVDEUVD-2024-0949
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
- Record
EUVD-2024-0949- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-jhwx-mhww-rgc3
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
Impact
All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
v2.10.5 v2.9.10 v2.8.14
For more information
If you have any questions or comments about this advisory:
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
Credits
This vulnerability was found & reported by Jakub Ciolek
The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
- Record
GHSA-jhwx-mhww-rgc3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
NVD
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
- Record
CVE-2024-29893- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
- Record
CVE-2024-29893- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVGHSA-jhwx-mhww-rgc3
ArgoCD's repo server has Uncontrolled Resource Consumption vulnerability
Impact
All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it.
Patches
A patch for this vulnerability has been released in the following Argo CD versions:
v2.10.5 v2.9.10 v2.8.14
For more information
If you have any questions or comments about this advisory:
Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd
Credits
This vulnerability was found & reported by Jakub Ciolek
The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue
- Record
GHSA-jhwx-mhww-rgc3- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVRHSA-2024:1752
Red Hat Security Advisory: GitOps 1.12.1- Argo CD CLI and MicroShift GitOps security update
- Record
RHSA-2024:1752- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-argo-cd-2024-29893 No score
Uncontrolled Resource Consumption vulnerability in ArgoCD's repo server
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.
- Record
BIT-argo-cd-2024-29893- Updated
- 2026-11-02
OSVGO-2024-2667 No score
Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2
Out of memory crash from malicious Helm registry in github.com/argoproj/argo-cd/v2
- Record
GO-2024-2667- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/argoproj/argo-cd/v2Go |
2.4.0 up to 2.8.14 | 2.8.14 |
github.com/argoproj/argo-cd/v2Go |
2.9.0 up to 2.9.10 | 2.9.10 |
github.com/argoproj/argo-cd/v2Go |
2.10.0 up to 2.10.5 | 2.10.5 |
argo-cdBitnami |
2.4.0 up to 2.10.5 | 2.10.5 |
github.com/argoproj/argo-cd/v2Go |
2.4.0 up to 2.8.14, 2.9.0 up to 2.9.10, 2.10.0 up to 2.10.5 | 2.8.142.9.102.10.5 |
openshift-gitops-argocd-cliRed Hat:openshift_gitops:1.12::el8 From an advisory covering 5 CVEs |
before 0:1.12.1-5.el8 | 0:1.12.1-5.el8 |
openshift-gitops-argocd-cli-redistributableRed Hat:openshift_gitops:1.12::el8 From an advisory covering 5 CVEs |
before 0:1.12.1-5.el8 | 0:1.12.1-5.el8 |
microshift-gitopsRed Hat:openshift_gitops:1.12::el9 From an advisory covering 5 CVEs |
before 0:1.12.1-4.el9 | 0:1.12.1-4.el9 |
microshift-gitops-release-infoRed Hat:openshift_gitops:1.12::el9 From an advisory covering 5 CVEs |
before 0:1.12.1-4.el9 | 0:1.12.1-4.el9 |
openshift-gitops-argocd-cliRed Hat:openshift_gitops:1.12::el9 From an advisory covering 5 CVEs |
before 0:1.12.1-4.el9 | 0:1.12.1-4.el9 |
openshift-gitops-argocd-cli-redistributableRed Hat:openshift_gitops:1.12::el9 From an advisory covering 5 CVEs |
before 0:1.12.1-4.el9 | 0:1.12.1-4.el9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-29893 is a medium vulnerability (CVSS 6.5) in Argoproj Argo Cd, published March 29, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.97%, the 62nd percentile. Fixed in github.com/argoproj/argo-cd/v2 2.8.14.
References
github.com/argoproj/argo-cd/security/advisories/GHSA-jhwx-mhww-rgc3
nvd.nist.gov/vuln/detail/CVE-2024-29893
Show 34 moreShow less
access.redhat.com/errata/RHSA-2024:1752
docs.openshift.com/gitops/latest/understanding_openshift_gitops/about-redhat-openshift-gitops.html
bugzilla.redhat.com/show_bug.cgi?id=2269479
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_1752.json
cve.org/CVERecord?id=CVE-2023-50726
argo-cd.readthedocs.io/en/latest/operator-manual/rbac