CVE-2025-59538 Argo CD is Vulnerable to Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook

What is CVE-2025-59538?

CVE-2025-59538 is a high-severity denial of service vulnerability in Argoproj Argo Cd, published on 1 Oct 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. For versions 2.9.0-rc1 through 2.14.19, 3.0.0-rc1 through 3.2.0-rc1, 3.1.6 and 3.0.17, when the webhook.azuredevops.username and webhook.azuredevops.password are not set in the default configuration, the /api/webhook endpoint crashes the entire argocd-server process when it receives an Azure DevOps Push event whose JSON array resource.refUpdates is empty. The slice index [0] is accessed without a length check, causing an index-out-of-range panic. A single unauthenticated HTTP POST is enough to kill the process. This issue is resolved in versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19.

Weakness: CWE-703, CWE-248

Which versions are affected by CVE-2025-59538?

12 open source packages ship an affected version, including github.com/argoproj/argo-cd/v3, argo-cd and github.com/argoproj/argo-cd. It affects 1 product.

Products include Argoproj Argo Cd.

How do I fix CVE-2025-59538?

Upgrade github.com/argoproj/argo-cd/v3 to a fixed version for your release line: 3.0.19, 3.1.8 or 3.2.0-rc2.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2025-59538 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-59538 exists.

Other vulnerabilities in Argoproj Argo Cd

• CVE-2025-55190 Argo CD: Project API Token Exposes Repository Credentials Critical 10.0
• CVE-2022-29165 Argo CD will blindly trust JWT claims if anonymous access is enabled Critical 10.0
• CVE-2023-40029 Cluster secret might leak in cluster details page in Argo CD Critical 9.9
• CVE-2022-24768 Improper access control allows admin privilege escalation in Argo CD Critical 9.9
• CVE-2024-21652 Argo CD vulnerable to Bypassing of Brute Force Protection via Application Crash and In-Memory Data Loss Critical 9.8

All Argoproj Argo Cd vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-argo-cd-2025-59538, CLEANSTART-2026-KN43906, GHSA-gpx4-37g2-c8pv, GO-2025-3995, MINI-5753-2gwx-fx73, MINI-5gv4-hjcp-rv89 and 8 more.