CVE-2024-40634

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. This report details a security vulnerability in Argo CD, where an unauthenticated attacker can send a specially crafted large JSON payload to the /api/webhook endpoint, causing excessive memory allocation that leads to service disruption by triggering an Out Of Memory (OOM) kill. The issue poses a high risk to the availability of Argo CD deployments. This vulnerability is fixed in 2.11.6, 2.10.15, and 2.9.20.

• CWE-400

• https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdcPatch
• https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36Patch
• https://github.com/argoproj/argo-cd/commit/d881ee78949e23160a0b280bb159e4d3d625a4dfPatch
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3wExploit, Vendor Advisory
• https://github.com/argoproj/argo-cd/commit/46c0c0b64deaab1ece70cb701030b76668ad0cdcPatch
• https://github.com/argoproj/argo-cd/commit/540e3a57b90eb3655db54793332fac86bcc38b36Patch
• https://github.com/argoproj/argo-cd/commit/d881ee78949e23160a0b280bb159e4d3d625a4dfPatch
• https://github.com/argoproj/argo-cd/security/advisories/GHSA-jmvp-698c-4x3wExploit, Vendor Advisory

Published

Jul 22, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-40629JumpServer is an open-source Privileged Access Management (P…9.8
• CVE-2024-4063A vulnerability was found in EZVIZ CS-C6-21WFR-8 5.2.7 Build…3.7
• CVE-2024-40630OpenImageIO is a toolset for reading, writing, and manipulat…4.3
• CVE-2024-40631Plate media is an open source, rich-text editor for React. E…8.1
• CVE-2024-40632Linkerd is an open source, ultralight, security-first servic…3.7
• CVE-2024-40633Sylius is an Open Source eCommerce Framework on Symfony. A s…5.3
• CVE-2024-40635containerd is an open-source container runtime. A bug was fo…7.8
• CVE-2024-40636Steeltoe is an open source project that provides a collectio…5.3
• CVE-2024-40637dbt enables data analysts and engineers to transform their d…7.8
• CVE-2024-40638GLPI is a free asset and IT management software package. An …8.8
• CVE-2024-40639Rejected reason: This CVE is a duplicate of another CVE.
• CVE-2024-4064A vulnerability was found in Tenda AC8 16.03.34.09. It has b…8.8