CVE-2024-21661 Argo CD Denial of Service (DoS) Vulnerability Due to Unsafe Array Modification in Multi-threaded Environment

What is CVE-2024-21661?

CVE-2024-21661 is a high-severity vulnerability in Argoproj Argo Cd, published on 18 Mar 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to versions 2.8.13, 2.9.9, and 2.10.4, an attacker can exploit a critical flaw in the application to initiate a Denial of Service (DoS) attack, rendering the application inoperable and affecting all users. The issue arises from unsafe manipulation of an array in a multi-threaded environment. The vulnerability is rooted in the application's code, where an array is being modified while it is being iterated over. This is a classic programming error but becomes critically unsafe when executed in a multi-threaded environment. When two threads interact with the same array simultaneously, the application crashes. This is a Denial of Service (DoS) vulnerability. Any attacker can crash the application continuously, making it impossible for legitimate users to access the service. The issue is exacerbated because it does not require authentication, widening the pool of potential attackers. Versions 2.8.13, 2.9.9, and 2.10.4 contain a patch for this issue.

Weakness: CWE-787

Which versions are affected by CVE-2024-21661?

10 open source packages ship an affected version, including github.com/argoproj/argo-cd/v2, argo-cd and github.com/argoproj/argo-cd. It affects 1 product.

Products include Argoproj Argo Cd.

How do I fix CVE-2024-21661?

Upgrade github.com/argoproj/argo-cd/v2 to a fixed version for your release line: 2.8.13, 2.9.9 or 2.10.4.

Is CVE-2024-21661 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-21661 exists.

Other vulnerabilities in Argoproj Argo Cd

• CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials Critical 10.0
• CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled Critical 10.0
• CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD Critical 9.9
• CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD Critical 9.9
• CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss Critical 9.8

All Argoproj Argo Cd vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-argo-cd-2024-21661, GHSA-6v85-wr92-q4p7, GO-2024-2654.