6.5

CVE-2024-29893: argoproj argo_cd Uncontrolled Resource Consumption

CVSS: 6.5v3.1MediumAnalyzed
AliasesGHSA-jhwx-mhww-rgc3BIT-argo-cd-2024-29893GO-2024-2667
Published 29-03-2024Last modified 02-08-2024
Open JSON

Vulnerability summary

CVE-2024-29893 is a medium (CVSS 6.5) Uncontrolled Resource Consumption vulnerability in argoproj argo_cd. EPSS estimates a 0.97% chance of exploitation in the next 30 days, higher than 61.3% of scored vulnerabilities.

Overall risk
26/100
0100
Medium · default modelHow is this calculated?
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.97%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 5
RHSA-2024:1752CGA-2G6G-Q26W-MF5GCGA-37QH-WP77-R6Q6CGA-G372-GF27-JV8RCGA-X3WC-XRQF-427XCGA-X4M7-GPM3-45CQ

Timeline

  1. 29-03-2024
    PublishedVulnerability first disclosed.
  2. 02-08-2024
    Last modifiedVulnerability information updated.

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of ArgoCD starting from v2.4 have a bug where the ArgoCD repo-server component is vulnerable to a Denial-of-Service attack vector. Specifically, it's possible to crash the repo server component through an out of memory error by pointing it to a malicious Helm registry. The loadRepoIndex() function in the ArgoCD's helm package, does not limit the size nor time while fetching the data. It fetches it and creates a byte slice from the retrieved data in one go. If the registry is implemented to push data continuously, the repo server will keep allocating memory until it runs out of it. A patch for this vulnerability has been released in v2.10.3, v2.9.8, and v2.8.12.

CVSS metrics

3 scores · 3 sources · 1 version

EPSS trend

Probability

0.97%

Chance of exploitation in the next 30 days

Percentile

61%

Versus all other CVEs

30-day change

0.00 pp

From 0.97% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.97%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Argoproj2 products
  • argo_cd≥ 2.4.0, < 2.8.14 | ≥ 2.9.0, < 2.9.10 | ≥ 2.10.0, < 2.10.5
  • argo-cd≥ 2.4.0, < 2.8.14 | ≥ 2.9.0, < 2.9.10 | ≥ 2.10.0, < 2.10.5
Github.com/argoproj/argo-cd1 product
  • v2≥ 2.4.0, < 2.8.14 | ≥ 2.9.0, < 2.9.10 | ≥ 2.10.0, < 2.10.5

2 vendors · 3 products

References

6 links