argoproj argo-cd up to 3.2.0-rc1 API Request /api/webhook commits[].repo denial of service

Summaryinfo

A vulnerability has been found in argoproj argo-cd up to 1.8.7/2.14.19/3.0.18/3.1.7/3.2.0-rc1 and classified as problematic. Affected by this issue is some unknown functionality of the file /api/webhook of the component API Request Handler. Performing a manipulation of the argument commits[].repo results in denial of service. This vulnerability is cataloged as CVE-2025-59537. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in argoproj argo-cd up to 1.8.7/2.14.19/3.0.18/3.1.7/3.2.0-rc1. It has been classified as problematic. This affects an unknown part of the file /api/webhook of the component API Request Handler. The manipulation of the argument commits[].repo with an unknown input leads to a denial of service vulnerability. CWE is classifying the issue as CWE-404. The product does not release or incorrectly releases a resource before it is made available for re-use. This is going to have an impact on availability. The summary by CVE is:

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Versions 1.2.0 through 1.8.7, 2.0.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.7 and 3.0.18 are vulnerable to malicious API requests which can crash the API server and cause denial of service to legitimate clients. With the default configuration, no webhook.gogs.secret set, Argo CD’s /api/webhook endpoint will crash the entire argocd-server process when it receives a Gogs push event whose JSON field commits[].repo is not set or is null. This issue is fixed in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2025-59537 since 09/17/2025. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1499 according to MITRE ATT&CK.

Upgrading to version 2.14.20, 3.0.19, 3.1.8 or 3.2.0-rc2 eliminates this vulnerability. Applying the patch 761fc27068d2d4cd24e1f784eb2a9033b5ee7f43 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the vulnerability database at CERT Bund (WID-SEC-2025-2251). Be aware that VulDB is the high quality source for vulnerability data.

Affected

• Red Hat Enterprise Linux
• Red Hat OpenShift GitOps

Productinfo

Vendor

• argoproj

Name

• argo-cd

Version

• 1.8.0
• 1.8.1
• 1.8.2
• 1.8.3
• 1.8.4
• 1.8.5
• 1.8.6
• 1.8.7
• 2.14.0
• 2.14.1
• 2.14.2
• 2.14.3
• 2.14.4
• 2.14.5
• 2.14.6
• 2.14.7
• 2.14.8
• 2.14.9
• 2.14.10
• 2.14.11
• 2.14.12
• 2.14.13
• 2.14.14
• 2.14.15
• 2.14.16
• 2.14.17
• 2.14.18
• 2.14.19
• 3.0.0
• 3.0.1
• 3.0.2
• 3.0.3
• 3.0.4
• 3.0.5
• 3.0.6
• 3.0.7
• 3.0.8
• 3.0.9
• 3.0.10
• 3.0.11
• 3.0.12
• 3.0.13
• 3.0.14
• 3.0.15
• 3.0.16
• 3.0.17
• 3.0.18
• 3.1.0
• 3.1.1
• 3.1.2
• 3.1.3
• 3.1.4
• 3.1.5
• 3.1.6
• 3.1.7
• 3.2.0-rc1

License

• open-source

Website

• Product: https://github.com/argoproj/argo-cd/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion