Back to Database
Status published
Medium
CVE-2024-32476
Denial of Service via malicious jqPathExpressions in ignoreDifferences
Vulnerability Description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-32476
Credits & Attribution
No credits recorded in the NVD database.
References
- https://github.com/argoproj/argo-cd/security/advisories/GHSA-9m6p-x4h2-6frq
- https://github.com/argoproj/argo-cd/commit/7893979a1e78d59cedd0ba790ded24e30bb40657
- https://github.com/argoproj/argo-cd/commit/9e5cc5a26ff0920a01816231d59fdb5eae032b5a
- https://github.com/argoproj/argo-cd/commit/e2df7315fb7d96652186bf7435773a27be330cac
More from argoproj
View All →CVE-2025-66626
argoproj/argo-workflows is vulnerable to RCE via ZipSlip and symbolic links
High
8.1
CVE-2025-62157
Argo Workflows exposes artifact repository credentials in workflow-controller logs
High
8.5
CVE-2025-62156
argo-workflows Zip Slip path traversal allows arbitrary file write and container configuration overwrite
High
8.1
CVE-2025-59538
Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
High
7.5
CVE-2025-59537
argo-cd is vulnerable to unauthenticated DoS attack via malformed Gogs webhook payload
High
7.5
Affected Vendor
argoproj
View all reports →Affected Software
argo-cd
Vulnerable Versions:
>= 2.10.0, < 2.10.8, >= 2.9.0, < 2.9.13, < 2.8.17
Timeline
Official Publish:
April 26th, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H