GHSA-9m6p-x4h2-6frq BIT-argo-cd-2024-32476 CVE-2024-32476 GO-2024-2792

Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences

Medium Go

Severity: 6.5 / 10; Medium · CVSS 3.1
Exploit chance (EPSS): 1.00%; Chance of exploitation in the next 30 days. Higher than 62.99% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-400 Uncontrolled Resource Consumption
Fix: 2.10.8; Upgrade github.com/argoproj/argo-cd/v2 to this version or later

Description

Impact

DoS vuln via OOM using jq in ignoreDifferences.

ignoreDifferences:
    - group: apps
       kind: Deployment
       jqPathExpressions: 
	    - 'until(true == false; [.] + [1])'

Patches

A patch for this vulnerability has been released in the following Argo CD versions:

v2.10.8 v2.9.13 v2.8.17

For more information

If you have any questions or comments about this advisory:

Open an issue in the Argo CD issue tracker or discussions Join us on Slack in channel #argo-cd

Credits This vulnerability was found & reported by @crenshaw-dev (Michael Crenshaw)

The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue

Affected versions

Go

Package	Vulnerable	Fixed in
github.com/argoproj/argo-cd	`all versions`	No fix yet
github.com/argoproj/argo-cd/v2	`>= 2.10.0, < 2.10.8`	`2.10.8`
github.com/argoproj/argo-cd/v2	`>= 2.9.0, < 2.9.13`	`2.9.13`
github.com/argoproj/argo-cd/v2	`< 2.8.17`	`2.8.17`
github.com/argoproj/argo-cd/v2	`< 2.8.17` `>= 2.9.0, < 2.9.13` `>= 2.10.0, < 2.10.8`	`2.8.17` `2.9.13` `2.10.8`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

github.com/argoproj/argo-cd/v2 Go → `2.10.8`

go

go get github.com/argoproj/argo-cd/v2@v2.10.8 && go mod tidy

Severity breakdown

CVSS 3.1 6.5

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack vector: Network
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: High

Weakness

CWE-400: Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

How to prevent it

Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
Implementation: Ensure that all failures in resource allocation place the system into a safe posture.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2024-32476

Packages

github.com/argoproj/argo-cd

Timeline

Apr 26, 2024 Published
Aug 7, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-fmxq-cgp8-87wp Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks	Critical	Also affects github.com/argoproj/argo-cd
GHSA-j6cw-g6p4-7hch Argo CD repo-server command injection via crafted SSH repository SOCKS5 proxy URL	High	Also affects github.com/argoproj/argo-cd
GHSA-h98r-wv3h-fr38 Argo CD: Stored XSS in application link annotations enables developer-to-admin privilege escalation	High	Also affects github.com/argoproj/argo-cd
GO-2026-5618 Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations	Medium	Also affects github.com/argoproj/argo-cd
GO-2026-5099 ArgoCD ServerSideDiff is vulnerable to Kubernetes Secret Extraction	Critical	Also affects github.com/argoproj/argo-cd
GHSA-gpx4-37g2-c8pv Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook	High	Also affects github.com/argoproj/argo-cd
GHSA-wp4p-9pxh-cgx2 argo-cd vulnerable unauthenticated DoS via malformed Gogs webhook payload	High	Also affects github.com/argoproj/argo-cd
GHSA-f9gq-prrc-hrhc Unauthenticated argocd-server panic via a malicious Bitbucket-Server webhook payload	High	Also affects github.com/argoproj/argo-cd

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor