CVE-2026-42294

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-42294
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42294.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-42294
Aliases
Downstream
Published
2026-05-09T03:45:48.180Z
Modified
2026-07-08T08:13:14.397773940Z
Severity
  • 8.2 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N CVSS Calculator
Summary
Argo Workflows: Unauthenticated Memory Exhaustion (DoS) in Webhook Interceptor
Details

Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Prior to versions 3.7.14 and 4.0.5, the Webhook Interceptor loads the entire request body into memory before authenticating the request or verifying its signature. This occurs on the /api/v1/events/ endpoint, which is publicly accessible (albeit intended for webhooks). An attacker can send a request with an extremely large body (e.g., multiple gigabytes), causing the Argo Server to allocate excessive memory, potentially leading to an Out-Of-Memory (OOM) crash and denial of service. This issue has been patched in versions 3.7.14 and 4.0.5.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/42xxx/CVE-2026-42294.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-770"
    ]
}
References

Affected packages

Git / github.com/argoproj/argo-workflows

Affected ranges

Type
GIT
Repo
https://github.com/argoproj/argo-workflows
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
ca37b537cd34d18029146a755bf42a9b2364c49b
Introduced
a8bff4a72130bc1a13d95c6f73ff3fafec880287
Fixed
0ab1452144d8f4d57c50b37ce50dad218868e950
Fixed
7abb4de6c3599e2d5d960ba4d5de4cf1df109965
Database specific 
{
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "cpe": "cpe:2.3:a:argoproj:argo_workflows:*:*:*:*:*:go:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "3.7.14"
        },
        {
            "introduced": "4.0.0"
        },
        {
            "fixed": "4.0.5"
        }
    ]
}

Affected versions

Other
ui-v3-rc1
v2.*
v2.0.0
v2.0.0-alpha1
v2.0.0-alpha2
v2.0.0-alpha3
v2.0.0-beta1
v2.1.0
v2.1.0-alpha1
v2.1.0-beta1
v2.1.0-beta2
v2.1.1
v2.10.0-rc1
v2.2.0
v2.2.1
v2.3.0-rc1
v2.3.0-rc2
v2.3.0-rc3
v3.*
v3.1.0-rc1
v3.2.0-rc1
v3.2.0-rc2
v3.2.0-rc3
v3.2.0-rc4
v3.3.0-rc1
v3.3.0-rc2
v3.3.0-rc3
v3.3.0-rc4
v3.3.0-rc5
v3.3.0-rc6
v3.3.0-rc7
v3.3.0-rc8
v3.4.0-rc1
v3.4.0-rc2
v3.4.0-rc3
v3.4.0-rc4
v3.5.0
v3.5.0-rc1
v3.5.0-rc2
v3.6.0
v3.6.0-rc1
v3.6.0-rc2
v3.6.0-rc3
v3.6.0-rc4
v3.7.0
v3.7.0-rc1
v3.7.0-rc2
v3.7.0-rc3
v3.7.0-rc4
v3.7.1
v3.7.10
v3.7.11
v3.7.12
v3.7.13
v3.7.2
v3.7.3
v3.7.4
v3.7.5
v3.7.6
v3.7.7
v3.7.8
v3.7.9
v4.*
v4.0.0
v4.0.1
v4.0.2
v4.0.3
v4.0.4

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-42294.json"