Skip to content
Fencer Vulns
high 7.5

CVE-2024-21661 json

Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

published 2024-03-18 2 y ago modified 2026-09-10 1 mo ago also BIT-argo-cd-2024-21661 , EUVD-2024-0850 , GHSA-6v85-wr92-q4p7 , GO-2024-2654

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
1.2%
EPSS 1.2% chance of exploitation in 30 days, percentile 67%
public exploits
0
none known

Summary

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment. The vulnerability is rooted in the application's code, where an array is being modified while it is being iterated over. This is a classic programming error but becomes critically unsafe when executed in a multi-threaded environment. When two threads interact with the same array simultaneously, the application crashes. This is a Denial of Service (DoS) vulnerability. Any attacker can crash the application continuously, making it impossible for legitimate users to access the service. The issue is exacerbated because it does not require authentication, widening the pool of potential attackers. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.

Patch / fix

  • go github.com/argoproj/argo-cd/v2 2.8.13, 2.9.9, 2.10.4
  • bitnami argo-cd 2.10.4
  • argoproj argo-cd 2.8.13, 2.9.9, 2.10.4
  • microshift-gitops openshift gitops 1.12 1.12.1-4.el9
  • openshift-gitops-argocd-cli openshift gitops 1.12 1.12.1-5.el8
  • openshift-gitops-argocd-cli openshift gitops 1.12 1.12.1-4.el9
  • microshift-gitops-release-info openshift gitops 1.12 1.12.1-4.el9
  • openshift-gitops-argocd-cli-redistributable openshift gitops 1.12 1.12.1-5.el8
  • openshift-gitops-argocd-cli-redistributable openshift gitops 1.12 1.12.1-4.el9

red hat advisories RHSA-2024:1752

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-21661 updated cvss 7.5

argo-cd: Denial of Service Due to Unsafe Array Modification in Multi-threaded Environment

  • Red Hat Openshift Data Foundation 4 odf4/odr-rhel8-operator
    affected: workaround, no fix available “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.”
  • Red Hat OpenShift GitOps 1.10 openshift-gitops-1/dex-rhel8 v1.10.4-1, openshift-gitops-1/argocd-rhel8 v1.10.4-1, openshift-gitops-1/gitops-rhel8 v1.10.4-1, openshift-gitops-1/must-gather-rhel8 v1.10.4-1, openshift-gitops-1/kam-delivery-rhel8 v1.10.4-1, openshift-gitops-1/argo-rollouts-rhel8 v1.10.4-1, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:1700
  • Red Hat OpenShift GitOps 1.11 openshift-gitops-1/dex-rhel8 v1.11.3-2, openshift-gitops-1/argocd-rhel8 v1.11.3-2, openshift-gitops-1/gitops-rhel8 v1.11.3-2, openshift-gitops-1/must-gather-rhel8 v1.11.3-2, openshift-gitops-1/kam-delivery-rhel8 v1.11.3-2, openshift-gitops-1/argo-rollouts-rhel8 v1.11.3-2, +3 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:1697
  • Red Hat OpenShift GitOps 1.12 microshift-gitops 1.12.1-4.el9, openshift-gitops-1/dex-rhel8 v1.12.1-1, openshift-gitops-argocd-cli 1.12.1-4.el9, openshift-gitops-argocd-cli 1.12.1-5.el8, openshift-gitops-1/argocd-rhel8 v1.12.1-1, openshift-gitops-1/argocd-rhel9 v1.12.1-2, +10 more
    fixed: vendor fix “Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.” RHSA-2024:1753

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
2 y ago

Exploit prediction

1.18% chance of exploitation in the next 30 days, higher than 67% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/argoproj/argo-cd/security/advisories/GHSA-6v85-wr92-q4p7 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
go github.com/argoproj/argo-cd
<=1.8.7
 no fix listed
go github.com/argoproj/argo-cd/v2
<2.8.13
>=2.9.0, <2.9.9
>=2.10.0, <2.10.4
2.8.13
2.9.9
2.10.4
bitnami argo-cd
<2.10.4
2.10.4

Affected products

  • argoproj argo-cd

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.