CVE-2024-40634

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

VendorProductVersions
argoprojargo-cd>= 1.0.0, < 2.9.20; >= 2.10.0, < 2.10.15; >= 2.11.0, < 2.11.6
argoprojargo-cd>= 1.0.0, < 2.9.20; >= 2.10.0, < 2.10.15; >= 2.11.0, < 2.11.6

References

Timeline

Published
Jul 22, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-406357.8containerd is an open-source container runtime. A bug was found in containerd prior to versions 1.6.38, 1.7.27, and 2.0.4 where containers lCVE-2024-406365.3Steeltoe is an open source project that provides a collection of libraries that helps users build production-grade cloud-native applicationsCVE-2024-406377.3dbt enables data analysts and engineers to transform their data using the same practices that software engineers use to build applications. CVE-2024-406388.8GLPI is a free asset and IT management software package. An authenticated user can exploit multiple SQL injection vulnerabilities. One of thCVE-2024-40648.8A vulnerability was found in Tenda AC8 16.03.34.09. It has been declared as critical. This vulnerability affects the function R7WebsSecurityCVE-2024-406402.9vodozemac is an open source implementation of Olm and Megolm in pure Rust. Versions before 0.7.0 of vodozemac use a non-constant time base6CVE-2024-406417.4Nuclei is a fast and customizable vulnerability scanner based on simple YAML based DSL. In affected versions it a way to execute code templCVE-2024-406428.1The netty incubator codec.bhttp is a java language binary http parser. In affected versions the `BinaryHttpParser` class does not properly vCVE-2024-406439.6Joplin is a free, open source note taking and to-do application. Joplin fails to take into account that "<" followed by a non letter charactCVE-2024-406446.8gitoxide An idiomatic, lean, fast & safe pure Rust implementation of Git. `gix-path` can be tricked into running another `git.exe` placed inCVE-2024-406458.8FOG is a cloning/imaging/rescue suite/inventory management system. An improperly restricted file upload feature allows authenticated users tCVE-2024-406468.6Vertex is a management tool for PT (Private Tracker) users to manage streaming and watching videos. Versions prior to commit fbde301b97986d5