Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 1 product
🚨 HIGH Severity: CVE-2025-59538 (CVSS 7.5) Argo CD webhook vulnerability allows unauthenticated DoS via single HTTP POST. Affects versions 2.9.0-2.14.19, 3.0.0-3.2.0-rc1. Patch immediately to 2.14.20, 3.1.8, 3.0.19, or 3.2.0-rc2. #CVE #ArgoCD #PatchNow https://t.co/XZaaTLmz7d
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | argoproj | argo_cd | - | - | - |
| App | argoproj | argo_cd | 3.2.0 | - | - |