DoS Flaws in Argo CD: Unauthenticated Attackers Can Crash Kubernetes Server with Single Request

The Argo CD project has released patches for several denial-of-service vulnerabilities that could crash the argocd-server process with a single unauthenticated HTTP request, affecting webhook integrations with Azure DevOps, Bitbucket Server and Gogs, plus a race condition in repository credential handling.

One of the most severe issues, CVE-2025-59538, carries a CVSS score of 7.5 and is described as the default configuration causing the /api/webhook endpoint to crash the argocd-server when it receives an Azure DevOps Push event whose JSON array resource[.]refUpdates is empty. Because the handler does not check the array length, an attacker can send a crafted webhook event with refUpdates: [], triggering an index-out-of-range panic, and the claim that a single unauthenticated HTTP POST is enough to kill the process.

A similar issue exists with Bitbucket Server webhooks (CVE-2025-59531, CVSS 7.5) and with Gogs integrations (CVE-2025-59537, CVSS 7.5), where malformed JSON or non-array fields trigger crashes. The advisory notes a race condition (CVE-2025-55191, CVSS 6.5) in the repository credentials handler that can lead to panics under concurrent map access, even with a valid API token.

According to CVE Watchtower, the project recommends upgrading to versions 2.14.20, 3.2.0-rc2, 3.1.8 and 3.0.19 and, in the meantime, setting webhook secrets to long, random values to effectively disable webhook handling for those payloads.