CVE-2022-31054— Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events
Quick assessment
Affected
argoproj argo-events
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Argo是一款开源的容器本机工作流引擎。 Kubernetes Argo Events 1.7.1 之前版本存在缓冲区错误漏洞，该漏洞源于 ioutil.ReadAll() 会将所有数据读入内存，攻击者利用该漏洞可以向 Argo Events 服务器发送大量请求使其崩溃并导致拒绝服务。
Possible ATT&CK Techniques 1 AI
T1499 · Endpoint Denial of Service
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2022-31054
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Uses of deprecated API can be used to cause DoS in user-facing endpoints in Argo Events
Source: CVE Program / CVE List V5
Vulnerability Description
Argo Events is an event-driven workflow automation framework for Kubernetes. Prior to version 1.7.1, several `HandleRoute` endpoints make use of the deprecated `ioutil.ReadAll()`. `ioutil.ReadAll()` reads all the data into memory. As such, an attacker who sends a large request to the Argo Events server will be able to crash it and cause denial of service. A patch for this vulnerability has been released in Argo Events version 1.7.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
未加控制的资源消耗(资源穷尽)
Source: CVE Program / CVE List V5
Vulnerability Title
Argo 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Argo是一款开源的容器本机工作流引擎。 Kubernetes Argo Events 1.7.1 之前版本存在缓冲区错误漏洞，该漏洞源于 ioutil.ReadAll() 会将所有数据读入内存，攻击者利用该漏洞可以向 Argo Events 服务器发送大量请求使其崩溃并导致拒绝服务。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| argoproj | argo-events | < 1.7.1 | - |
|
II. Public POCs for CVE-2022-31054
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-31054
请登录查看更多情报信息。
Patches & Fixes for CVE-2022-31054 (2)
-
https://github.com/argoproj/argo-events/pull/1966 x_refsource_MISC
Vendor Advisories for CVE-2022-31054 (1)
-
https://github.com/argoproj/argo-events/security/advisories/GHSA-5q86-62xr-3r57 x_refsource_CONFIRM
Other References for CVE-2022-31054 (1)
-
https://github.com/argoproj/argo-events/issues/1946 x_refsource_MISC
IV. Related Vulnerabilities
Same vendor: argoproj
-
CVE-2026-54526
Argo Workflows: Incomplete fix for CVE-2026-31892: ArtifactG -
CVE-2026-45737
Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideD -
CVE-2026-45738
Argo CD: Stored XSS in application link annotations enables -
CVE-2026-15416
Argo-cd: argo cd unauthenticated remote code execution in re -
CVE-2026-62185
Argo CD Helm Chart < 10.0.0 Missing Network Policy RCE
Same weakness: CWE-400
-
CVE-2026-15310
zipfile: bzip2/LZMA/Zstandard members decompress without a m -
CVE-2026-55531
PraisonAI: Unauthenticated unbounded session accumulation in -
CVE-2026-79658
Ech0 before 5.0.1 Denial of Service via Accept-Language -
CVE-2026-78684
vLLM before 0.27.0 Denial of Service via DeepStream Backend -
CVE-2026-12600
Uncontrolled memory usage in Innodata Labs’ Poppler JPX deco
V. Comments for CVE-2022-31054
No comments yet