Argo Workflows, an open source container-native workflow engine for Kubernetes, contains a resource allocation vulnerability (CWE-770) in its Webhook Interceptor prior to versions 3.7.14 and 4.0.5. The interceptor loads the entire request body into memory before authentication or signature verification on the /api/v1/events/ endpoint, which is publicly accessible. This allows an attacker to send a request with an extremely large body, causing the Argo Server to allocate excessive memory, potentially resulting in an Out-Of-Memory crash and denial of service. The vulnerability is addressed by patches in versions 3.7.14 and 4.0.5. The CVSS 4.0 score is 8.2, indicating high severity. No known exploits in the wild have been reported. The vendor advisory from Red Hat confirms the issue and the availability of fixed versions.

An attacker can cause the Argo Server to consume excessive memory by sending a large request body to the /api/v1/events/ endpoint, leading to an Out-Of-Memory crash and denial of service. This disrupts the availability of the Argo Workflows service. There is no indication of privilege escalation, data confidentiality, or integrity impact.

Upgrade Argo Workflows to version 3.7.14 or later, or 4.0.5 or later, where this vulnerability is patched. The vendor advisory confirms these versions contain the fix. No other mitigations are specified or required.