CVE-2025-59538

Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

HIGH 7.5

En bref

Source: NVD
EPSS: EPSS 9.36 % · centile 95 (2026-10-28)
État: PUBLISHED
Publiée: 2025-10-01 21:09 UTC
Mise à jour: 2025-10-02 15:54 UTC
Attribuée par: GitHub_M
Statut NVD: Analyzed

Description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

Faiblesses (CWE)

CWE-248 — Exception non interceptée
CWE-703 — Improper Check or Handling of Exceptional Conditions

Références

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	GitHub_M
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · security-advisories@github.com (Secondary)

Avis

GHSA-gpx4-37g2-c8pv — Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook
GO-2025-3995 — Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

Références européennes

ENISA EUVD · EUVD-2025-31758
GCVE · GCVE-0-2025-59538

Configurations affectées (CPE NVD)

cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* ≥ 2.9.0 < 2.14.20
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* ≥ 3.0.0 < 3.0.19
cpe:2.3:a:argoproj:argo_cd:*:*:*:*:*:*:*:* ≥ 3.1.0 < 3.1.8
cpe:2.3:a:argoproj:argo_cd:3.2.0:rc1:*:*:*:*:*:*

Produits affectés

Produit	Versions
argoproj · argo-cd	affected >= 2.9.0-rc1, < 2.14.20 ; affected >= 3.2.0-rc1, < 3.2.0-rc2 ; affected >= 3.1.0-rc1, < 3.1.8 ; affected >= 3.0.0-rc1, < 3.0.19

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD