{"id":"CVE-2022-31016","aliases":["GHSA-jhqp-vf4w-rpwq","GO-2022-0495"],"url":"https://o3.security/vulnerability/CVE-2022-31016","summary":"Argo CD vulnerable to Uncontrolled Memory Consumption","details":"### Impact\n\nAll versions of Argo CD starting with v0.7.0 are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the [repo-server](https://argo-cd.readthedocs.io/en/stable/operator-manual/architecture/#repository-server) service. The repo-server is a critical component of Argo CD, so crashing the repo-server effectively denies core Argo CD services (such as syncing Application updates).\n\nTo achieve denial of service, the attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. \n\n### Patches\n\nA patch for this vulnerability has been released in the following Argo CD versions:\n\n* v2.4.1\n* v2.3.5\n* v2.2.10\n* v2.1.16\n\n**The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production.** It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is `10M` per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.\n\nIf your organization uses directory-type Applications with very many manifests or very large manifests then **check the size of those manifests and tune the config parameter before deploying this change to production**. When testing, make sure to do a \"hard refresh\" in either the CLI or UI to test your directory-type App. That will make sure you're using the new max logic instead of relying on cached manifest responses from Redis.\n\n### Workarounds\n\nThere is no workaround besides upgrading.\n\nTo mitigate the issue, carefully limit 1) who can configure repos (determined by [RBAC](https://argo-cd.readthedocs.io/en/stable/getting_started/)), 2) which repos are allowed (determined by [Project](https://argo-cd.readthedocs.io/en/stable/user-guide/projects/) limitations), and 3) who has push access to those repos (determined by your SCM provider configuration).\n\n### Credits\n\nDisclosed by ADA Logics in a security audit of the Argo project sponsored by CNCF and facilitated by OSTIF. Thanks to Adam Korczynski and David Korczynski for their work on the audit.\n\n### For more information\n\n* Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\n* Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n","published":"2022-06-25T07:40:10Z","modified":"2026-08-12T03:51:20.102245121Z","cvss":{"score":6.5,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H"},"epss":{"score":0.00854,"percentile":0.55151,"asOf":"2026-08-23"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","fixedVersion":"2.1.16"},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","fixedVersion":"2.1.16"},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","fixedVersion":"2.2.10"},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","fixedVersion":"2.3.5"},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","fixedVersion":"2.4.1"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/31xxx/CVE-2022-31016.json"},{"type":"ADVISORY","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-jhqp-vf4w-rpwq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31016"},{"type":"PACKAGE","url":"https://github.com/argoproj/argo-cd"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:20.102245121Z"}}