{"id":"CVE-2022-31016","aliases":["EUVD-2022-6080","GHSA-jhqp-vf4w-rpwq","GO-2022-0495"],"status":"published","title":"Argo CD vulnerable to Uncontrolled Memory Consumption","description":"Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00901,"percentile":0.59942,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2022-06-21T22:51:05Z","modified":"2026-10-28T02:30:26Z","fixes":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd","fixed_in":["2.1.16"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","fixed_in":["2.1.16","2.2.10","2.3.5","2.4.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.7.0"},{"last_affected":"1.8.7"},{"fixed":"2.1.16"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.16"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.10"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.5"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"last_affected":"2.4.0"},{"fixed":"2.4.1"}]}],"versions":["2.4.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0"},{"fixed":"2.1.16"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.16"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.2.0"},{"fixed":"2.2.10"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.3.0"},{"fixed":"2.3.5"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}],"versions":["2.4.0"]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"0.7.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.1.16"},{"introduced":"2.2.0"},{"fixed":"2.2.10"},{"introduced":"2.3.0"},{"fixed":"2.3.5"},{"introduced":"2.4.0"},{"fixed":"2.4.1"}]}]}],"products":[{"vendor":"argoproj","product":"argo-cd"},{"vendor":"argoproj","product":"argo_cd"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31016","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-jhqp-vf4w-rpwq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31016.json","tags":["advisory"]},{"url":"https://github.com/argoproj/argo-cd","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-31016","title":"Argo CD vulnerable to Uncontrolled Memory Consumption","description":"Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.","status":"published","published":"2022-06-25T07:40:10Z","modified":"2025-04-23T18:08:48.592Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:35.279735Z"}],"euvd":[{"id":"EUVD-2022-6080","description":"Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.","status":"published","published":"2022-06-25T07:40:10Z","modified":"2025-04-23T18:08:48Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T20:52:09.387599Z"}],"ghsa":[{"id":"GHSA-jhqp-vf4w-rpwq","title":"DoS through large manifest files in Argo CD","description":"### Impact\n\nAll versions of Argo CD starting with v0.7.0 are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the [repo-server](https://argo-cd.readthedocs.io/en/stable/operator-manual/architecture/#repository-server) service. The repo-server is a critical component of Argo CD, so crashing the repo-server effectively denies core Argo CD services (such as syncing Application updates).\n\nTo achieve denial of service, the attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. \n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.4.1\n* v2.3.5\n* v2.2.10\n* v2.1.16\n\n**The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production.** It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is `10M` per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.\n\nIf your organization uses directory-type Applications with very many manifests or very large manifests then **check the size of those manifests and tune the config parameter before deploying this change to production**. When testing, make sure to do a \"hard refresh\" in either the CLI or UI to test your directory-type App. That will make sure you're using the new max logic instead of relying on cached manifest responses from Redis.\n\n### Workarounds\n\nThere is no workaround besides upgrading.\n\nTo mitigate the issue, carefully limit 1) who can configure repos (determined by [RBAC](https://argo-cd.readthedocs.io/en/stable/getting_started/)), 2) which repos are allowed (determined by [Project](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/) limitations), and 3) who has push access to those repos (determined by your SCM provider configuration).\n\n### Credits\n\nDisclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.\n\n### For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n","status":"published","published":"2022-06-21T22:51:05Z","modified":"2023-07-21T19:26:49Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:36:58.177785Z"}],"nvd":[{"id":"CVE-2022-31016","description":"Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.","status":"published","published":"2022-06-25T08:15:09.307Z","modified":"2026-06-17T04:44:36.707Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:07:22.613788Z"}],"osv":[{"id":"CVE-2022-31016","title":"Argo CD vulnerable to Uncontrolled Memory Consumption","description":"Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.","status":"published","published":"2022-06-25T07:40:10Z","modified":"2026-10-28T02:30:26.262645619Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:25.516981Z"},{"id":"GHSA-jhqp-vf4w-rpwq","title":"DoS through large manifest files in Argo CD","description":"### Impact\n\nAll versions of Argo CD starting with v0.7.0 are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the [repo-server](https://argo-cd.readthedocs.io/en/stable/operator-manual/architecture/#repository-server) service. The repo-server is a critical component of Argo CD, so crashing the repo-server effectively denies core Argo CD services (such as syncing Application updates).\n\nTo achieve denial of service, the attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. \n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.4.1\n* v2.3.5\n* v2.2.10\n* v2.1.16\n\n**The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production.** It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is `10M` per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.\n\nIf your organization uses directory-type Applications with very many manifests or very large manifests then **check the size of those manifests and tune the config parameter before deploying this change to production**. When testing, make sure to do a \"hard refresh\" in either the CLI or UI to test your directory-type App. That will make sure you're using the new max logic instead of relying on cached manifest responses from Redis.\n\n### Workarounds\n\nThere is no workaround besides upgrading.\n\nTo mitigate the issue, carefully limit 1) who can configure repos (determined by [RBAC](https://argo-cd.readthedocs.io/en/stable/getting_started/)), 2) which repos are allowed (determined by [Project](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/) limitations), and 3) who has push access to those repos (determined by your SCM provider configuration).\n\n### Credits\n\nDisclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.\n\n### For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n","status":"published","published":"2022-06-21T22:51:05Z","modified":"2024-08-21T15:41:38.419866Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"GO-2022-0495","title":"DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd","description":"DoS through large manifest files in Argo CD in github.com/argoproj/argo-cd","status":"published","published":"2024-08-21T15:11:33Z","modified":"2026-03-03T04:50:30.458931Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}