{"id":"CVE-2024-32476","aliases":["BIT-argo-cd-2024-32476","EUVD-2024-1173","GHSA-9m6p-x4h2-6frq","GO-2024-2792"],"status":"published","title":"Denial of Service via malicious jqPathExpressions in ignoreDifferences","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01005,"percentile":0.63262,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-04-26T15:24:13Z","modified":"2026-10-28T02:30:34Z","fixes":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","fixed_in":["2.10.8","2.9.13","2.8.17"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"argo-cd","fixed_in":["2.9.13","2.10.8"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.8"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.13"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.8.17"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.13"},{"introduced":"2.10.0"},{"fixed":"2.10.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.10.0"},{"fixed":"2.10.8"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.9.0"},{"fixed":"2.9.13"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.17"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.8.17"},{"introduced":"2.9.0"},{"fixed":"2.9.13"},{"introduced":"2.10.0"},{"fixed":"2.10.8"}]}]}],"products":[{"vendor":"argoproj","product":"argo-cd"},{"vendor":"argoproj","product":"argo_cd"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-32476","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-9m6p-x4h2-6frq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32476.json","tags":["advisory"]},{"url":"https://github.com/argoproj/argo-cd","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-32476","title":"Denial of Service via malicious jqPathExpressions in ignoreDifferences","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.","status":"published","published":"2024-04-26T15:24:13.245Z","modified":"2024-08-02T02:13:38.994Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:15.662528Z"}],"euvd":[{"id":"EUVD-2024-1173","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.","status":"published","published":"2024-04-26T15:24:13Z","modified":"2024-08-02T02:13:38Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-03T03:50:23.057649Z"}],"ghsa":[{"id":"GHSA-9m6p-x4h2-6frq","title":"Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences","description":"### Impact\nDoS vuln via OOM using jq in ignoreDifferences.\n\n```\nignoreDifferences:\n    - group: apps\n       kind: Deployment\n       jqPathExpressions: \n\t    - 'until(true == false; [.] + [1])'\n```\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.10.8\nv2.9.13\nv2.8.17\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\nCredits\nThis vulnerability was found \u0026 reported by @crenshaw-dev (Michael Crenshaw)\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","status":"published","published":"2024-04-26T16:40:35Z","modified":"2024-05-14T19:57:39Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:48.848211Z"}],"nvd":[{"id":"CVE-2024-32476","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.","status":"published","published":"2024-05-14T15:36:25.953Z","modified":"2026-06-17T07:29:42.147Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:09:57.497105Z"}],"osv":[{"id":"CVE-2024-32476","title":"Denial of Service via malicious jqPathExpressions in ignoreDifferences","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.","status":"published","published":"2024-04-26T15:24:13.245Z","modified":"2026-10-28T02:30:34.473813672Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-9m6p-x4h2-6frq","title":"Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences","description":"### Impact\nDoS vuln via OOM using jq in ignoreDifferences.\n\n```\nignoreDifferences:\n    - group: apps\n       kind: Deployment\n       jqPathExpressions: \n\t    - 'until(true == false; [.] + [1])'\n```\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.10.8\nv2.9.13\nv2.8.17\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\nCredits\nThis vulnerability was found \u0026 reported by @crenshaw-dev (Michael Crenshaw)\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","status":"published","published":"2024-04-26T16:40:35Z","modified":"2026-08-07T08:12:17.548215025Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"BIT-argo-cd-2024-32476","title":"Denial of Service via malicious jqPathExpressions in ignoreDifferences","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.","status":"published","published":"2024-05-24T07:16:04.154Z","modified":"2026-09-08T08:45:47.836984777Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"GO-2024-2792","title":"Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd","description":"Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences in github.com/argoproj/argo-cd","status":"published","published":"2024-06-04T15:19:21Z","modified":"2026-08-07T08:12:05.947288196Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}