A stack overflow vulnerability exists in the eslint component used by the argo-workflows package, affecting versions prior to 4.0.15-r2 and 4.1.6-r1. This vulnerability has a medium severity rating and can cause denial of service due to application crashes. A patch is available in versions 4.0.15-r2 and 4.1.6-r1.
CVE-2025-47907 is a high-severity security vulnerability in the argo-workflows package that affects versions prior to 4.1.6-r1. The flaw involves the cancellation of a query, which could lead to high confidentiality impact, low integrity impact, and low availability impact. A fix is available in version 4.1.6-r1.
A security vulnerability in argo-workflows exists when the PATH environment variable contains executable files instead of only directories. This flaw affects versions prior to 4.1.6-r1 and can cause unintended behavior when certain strings are passed to the LookPath function. The vulnerability has a medium severity rating and has been fixed in version 4.1.6-r1.
A security vulnerability in argo-workflows allowed improper access to the parent directory of the operating system. This issue affects versions prior to 4.1.6-r1 and has a low severity rating. The vulnerability has been fixed in version 4.1.6-r1.
A critical security vulnerability exists in the argo-workflows package where the net/http package improperly accepts a bare line feed (LF) as a line terminator in chunked data chunk-size lines. This flaw affects versions prior to 4.1.6-r1 and can lead to high impact on confidentiality and integrity without requiring user interaction.
A security vulnerability in argo-workflows allows improper handling of IPv6 zone IDs when matching hosts against proxy patterns. This flaw can cause the IPv6 zone ID to be incorrectly treated as part of the hostname. The issue affects versions prior to 4.1.6-r1 and has a medium severity rating. A fix is available in version 4.1.6-r1.
A security vulnerability in the argo-workflows package affects versions prior to 4.1.6-r1. The flaw arises from the use of a variable time instruction in the assembly implementation of an internal function on the ppc64le architecture, which leaks a small number of bits of secret scalars. This vulnerability has a medium severity rating and does not impact integrity or availability. A fix is available in version 4.1.6-r1.
A critical security vulnerability in the argo-workflows package allows HTTP Parameter Pollution (HPP) due to the use of insufficiently random values in form-data. This flaw affects versions prior to 4.0.15-r2 and 4.1.6-r1. The vulnerability has a high CVSS 4.0 score of 9.4, indicating severe impact. Fixed versions 4.0.15-r2 and 4.1.6-r1 have been released to address this issue.
A security vulnerability was identified in the juliangruber brace-expansion component used by the argo-workflows package. This vulnerability affects versions of argo-workflows prior to 4.0.15-r2 and 4.1.6-r1. The issue has a low severity score and impacts availability with no confidentiality or integrity impact. Fixed versions are available.
A security vulnerability in the argo-workflows package allows Proxy-Authorization and Proxy-Authenticate headers to persist on cross-origin redirects, potentially leaking sensitive information. This issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2025-4673. The vulnerability has a medium severity with a CVSS score of 6.8. A fix is available in version 4.1.6-r1.
CVE-2025-0913 is a medium severity security vulnerability in the argo-workflows package affecting versions prior to 4.1.6-r1. The flaw allows an attacker with low privileges and local access to cause a high impact on integrity without affecting confidentiality or availability. A fix is available in version 4.1.6-r1.
A security vulnerability in argo-workflows allows a certificate containing a URI with an IPv6 address that includes a zone ID to incorrectly satisfy a URI name constraint in the certificate chain. This flaw affects versions prior to 4.1.6-r1 and could lead to improper validation of certificate constraints.
A security vulnerability in the argo-workflows package causes the HTTP client to drop sensitive headers after following a cross-domain redirect. This issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2024-45336. The vulnerability has a medium severity with a CVSS score of 6.1. A fix is available in version 4.1.6-r1.
CVE-2024-45296 is a high-severity vulnerability in the argo-workflows package where the path-to-regexp component improperly converts path strings into regular expressions. This flaw can cause denial of service due to its impact on availability. Fixed versions 4.0.15-r2 and 4.1.6-r1 address the issue.
A security vulnerability in the argo-workflows package allows a panic due to stack exhaustion when calling Parse on a "// +build" build tag line with deeply nested expressions. This can cause denial of service by crashing the affected process. The issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2024-34158 with a high severity rating.
A high-severity security vulnerability (CVE-2024-34156) affects the argo-workflows package versions prior to 4.1.6-r1. The issue involves a flaw related to the 'Calling Decoder' component. This vulnerability does not impact confidentiality or integrity but causes a high impact on availability. A fix is available in version 4.1.6-r1.
A security vulnerability in the argo-workflows package allows a denial of service condition when calling any of the Parse functions on Go source code containing deeply nested literals. This can cause a panic due to stack exhaustion. The issue affects versions prior to 4.1.6-r1 and has been assigned CVE-2024-34155. A fix is available in version 4.1.6-r1.
CVE-2024-24791 is a high-severity security vulnerability in the argo-workflows package affecting versions prior to 4.1.6-r1. It involves the net/http HTTP/1 component and can cause an availability impact. A fix is available in version 4.1.6-r1.
A critical security vulnerability in the argo-workflows package caused various IP address classification methods (such as IsPrivate and IsLoopback) to incorrectly return false for IPv4-mapped IPv6 addresses that should have returned true. This flaw affects versions prior to 4.1.6-r1 and can lead to improper handling of IP addresses in security-sensitive contexts.
A security vulnerability exists in the argo-workflows package related to the archive/zip package's handling of certain invalid zip files. This handling differs from the behavior of most zip implementations, potentially leading to integrity issues. The vulnerability affects versions prior to 4.1.6-r1 and has a medium severity rating with a CVSS score of 5.5. A fix is available in version 4.1.6-r1.