Fluid Attacks Database

Description

Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd Argo CD Unauthenticated Remote DoS via malformed Azure DevOps git.push webhook in github.com/argoproj/argo-cd

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
go	github.com/argoproj/argo-cd/v3	=3.2.0-rc1 \|\| >=3.2.0-rc1 <3.2.0-rc2 \|\| >=3.1.0-rc1 <3.1.8 \|\| >=3.0.0-rc1 <3.0.19	3.2.0-rc2, 3.1.8, 3.0.19
go	github.com/argoproj/argo-cd	-	-
go	github.com/argoproj/argo-cd/v2	>=2.9.0-rc1 <2.14.20	2.14.20

Aliases

1. CVE-2025-595382. NVD-2025-595383. OSV-2025-595384. OSV-GO-2025-39955. GHSA-gpx4-37g2-c8pv6. GCVE-2025-595387. GHSA-gpx4-37g2-c8pv

References

1. https://github.com/argoproj/argo-cd/security/advisories/GHSA-gpx4-37g2-c8pv2. https://github.com/argoproj/argo-cd/commit/1a023f1ca7fe4ec942b4b6696804988d5a632baf3. https://pkg.go.dev/vuln/GO-2025-3995

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.