CLEANSTART-2026-YX17879 When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface

Security vulnerability affects the argo-cd package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

CLEANSTART-2026-ET86515 Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures

Security vulnerability affects the argo-cd package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

PT-2026-105228

Security vulnerability affects the argo-cd package. Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not...

PT-2026-105259

Security vulnerability affects the argo-cd package. When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface...

PT-2026-105251

Security vulnerability affects the argo-cd package. Parsing an invalid SVCB or HTTPS RR can panic when the size of a parameter value overflows the message buffer...

PT-2026-105252

Security vulnerability affects the argo-cd package. Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion...

PT-2026-105225

Security vulnerability affects the argo-cd package. Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: cloudbeat, manifest-tool, k9s-fips, kargo, cloudbeat-fips, gitness, kyverno, commercial-kyverno, kube-arangodb, opentofu-fips, helm-exporter, consul-k8s-fips, helm-mapkubeapis, flux-helm-controller, xeol-fips, argo-cd-fips, helm-push, k9s, kyverno-notation-aws,...

GHSA-H7VF-4X9W-H99V vulnerabilities

Vulnerabilities for packages: cloudbeat, manifest-tool, k9s-fips, kargo, cloudbeat-fips, gitness, kyverno, commercial-kyverno, kube-arangodb, opentofu-fips, helm-exporter, consul-k8s-fips, helm-mapkubeapis, flux-helm-controller, xeol-fips, argo-cd-fips, helm-push, k9s, kyverno-notation-aws,...

CLEANSTART-2026-AU20661 Security fix for GHSA-mh63-6h87-95cp applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0, argo-events 1.9.7-r1, argo-rollouts 1.9.0-r0, argo-rollouts-fips 1.9.0-r0, boring-registry-fips 0.15.5-r2, chartmuseum-fips 0.14.0-r1, chartmuseum-fips 0.15.0-r4, cortex-fips 0, cosign 2.4.3-r0, cosign 2.5.3-r0, external-dns-fips 0.16.1-r0, falcoctl 0.11.0-r0, harbor-fips 2.10.3-r0, harbor-fips 2.12.4-r1, harbor-fips 2.13.2-r1, harbor-registry 3.0.0.1-r2, kyverno-fips 1.12.7-r0, kyverno-policy-reporter-kyverno-plugin-fips 1.4.2-r4, minio-operator 6.0.4-r5, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, openbao-fips 2.1.1-r9, opentofu-fips 1.9.4-r0, step-cli 0.27.5-r0, tempo-fips 2.7.2-r0, velero-fips 1.14.1-r1, velero-fips 1.15.2-r0

GHSA-mh63-6h87-95cp affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-GU62349 Security fix for GHSA-4x4m-3c2p-qppc applied in: argo-cd 3.1.9-r4, argo-cd-fips 2.14.20-r1, argo-cd-fips 3.0.20-r2, argo-cd-fips 3.1.9-r4, calico-fips 3.29.5-r0, ip-masq-agent 2.12.6-r0, local-static-provisioner 2.8.0-r2, nfs-subdir-external-provisioner-fips 4.0.16-r0

GHSA-4x4m-3c2p-qppc affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UW16239 Security fix for GHSA-2v5j-vhc3-9cwm applied in: argo-cd 3.1.4-r0, argo-cd-fips 3.0.16-r0, argo-cd-fips 3.1.4-r0

GHSA-2v5j-vhc3-9cwm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ES01541 Security fix for CVE-2025-55190 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

CVE-2025-55190 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WW74873 Security fix for CVE-2025-55191 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

CVE-2025-55191 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-IS07646 Security fix for GHSA-92cp-5422-2m47 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

GHSA-92cp-5422-2m47 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CJ93592 Security fix for GHSA-2xsj-vh29-9cwm applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

GHSA-2xsj-vh29-9cwm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-XB80449 Security fix for GHSA-mw99-9chc-xw7r applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

GHSA-mw99-9chc-xw7r affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-EZ77524 Security fix for GHSA-3wgm-2mw2-vh5m applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

GHSA-3wgm-2mw2-vh5m affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CN12176 Security fix for GHSA-2vgg-9h3w-qbr4 applied in: argo-cd 2.13.9-r0, argo-cd-fips 2.13.9-r0

GHSA-2vgg-9h3w-qbr4 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-KN43906 Security fix for CVE-2025-59538 applied in: argo-cd 3.1.8.-r0, argo-cd-fips 3.1.8.-r0

CVE-2025-59538 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...