https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-07T03:11:17.597105+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2022-03978 bdu:2022-03978 2026-10-07T03:11:17.605862+00:00 bdu:2022-03978 https://cve.radiocsirt.org/vuln/euvd-2026-233972 EUVD-2026-233972 2026-10-07T03:11:17.605909+00:00 EUVD-2026-233972 https://cve.radiocsirt.org/vuln/fkie_cve-2022-31016 fkie_cve-2022-31016 2026-10-07T03:11:17.605931+00:00

Argo CD is a declarative continuous deployment for Kubernetes. Argo CD versions v0.7.0 and later are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the repo-server service, resulting in a Denial of Service. The attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file. The fix for this vulnerability is available in versions 2.3.5, 2.2.10, 2.1.16, and later. There are no known workarounds. Users are recommended to upgrade.

 https://cve.radiocsirt.org/vuln/ghsa-jhqp-vf4w-rpwq GHSA-jhqp-vf4w-rpwq — DoS through large manifest files in Argo CD 2026-10-07T03:11:17.605982+00:00

Affected: Go: github.com/argoproj/argo-cd, Go: github.com/argoproj/argo-cd/v2

### Impact

All versions of Argo CD starting with v0.7.0 are vulnerable to an uncontrolled memory consumption bug, allowing an authorized malicious user to crash the [repo-server](https://argo-cd.readthedocs.io/en/stable/operator-manual/architecture/#repository-server) service. The repo-server is a critical component of Argo CD, so crashing the repo-server effectively denies core Argo CD services (such as syncing Application updates).

To achieve denial of service, the attacker must be an authenticated Argo CD user authorized to deploy Applications from a repository which contains (or can be made to contain) a large file.

### Patches

A patch for this vulnerability has been released in the following Argo CD versions:

* v2.4.1 * v2.3.5 * v2.2.10 * v2.1.16

**The patch introduces a new `reposerver.max.combined.directory.manifests.size` config parameter, which you should tune before upgrading in production.** It caps the maximum total file size of .yaml/.yml/.json files in directory-type (raw manifest) Applications. The default max is `10M` per Application. This max is designed to keep any single app from consuming more than 3G of memory in the repo-server (manifests consume more space in memory than on disk). The 300x ratio assumes a maliciously-crafted manifest file. If you only want to protect against accidental excessive memory use, it is probably safe to use a smaller ratio.

If your organization uses directory-type Applications with very many manifests or very large ma…

 https://cve.radiocsirt.org/vuln/gsd-2022-31016 gsd-2022-31016 2026-10-07T03:11:17.606093+00:00 gsd-2022-31016 https://cve.radiocsirt.org/vuln/rhsa-2022:5152 RHSA-2022:5152 — Red Hat Security Advisory: Red Hat OpenShift GitOps security update 2026-10-07T03:11:17.606113+00:00

argocd: vulnerable to an uncontrolled memory consumption bug argocd: vulnerable to a variety of attacks when an SSO login is initiated from the Argo CD CLI or the UI. argocd: cross-site scripting (XSS) allow a malicious user to inject a javascript link in the UI argocd: vulnerable to a symlink following bug allowing a malicious user with repository write access