fkie_cve-2024-32476

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. There is a Denial of Service (DoS) vulnerability via OOM using jq in ignoreDifferences. This vulnerability has been patched in version(s) 2.10.7, 2.9.12 and 2.8.16.

GHSA-9m6p-x4h2-6frq — Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences

Affected: Go: github.com/argoproj/argo-cd/v2

### Impact DoS vuln via OOM using jq in ignoreDifferences.

``` ignoreDifferences: - group: apps kind: Deployment jqPathExpressions: - 'until(true == false; [.] + [1])' ```

### Patches A patch for this vulnerability has been released in the following Argo CD versions:

v2.10.8 v2.9.13 v2.8.17

### For more information If you have any questions or comments about this advisory:

Open an issue in [the Argo CD issue tracker](https://github.com/argoproj/argo-cd/issues) or [discussions](https://github.com/argoproj/argo-cd/discussions) Join us on [Slack](https://argoproj.github.io/community/join-slack) in channel #argo-cd

Credits This vulnerability was found & reported by @crenshaw-dev (Michael Crenshaw)

The Argo team would like to thank these contributors for their responsible disclosure and constructive communications during the resolve of this issue

Most recent entries from all

bdu:2024-05983

EUVD-2026-5131

fkie_cve-2024-32476

GHSA-9m6p-x4h2-6frq — Argo CD vulnerable to a Denial of Service via malicious jqPathExpressions in ignoreDifferences

gsd-2024-32476