# Snyk test report

March 8th 2026, 12:34:28 am (UTC+00:00)

Scanned the following paths:

- quay.io/argoproj/argocd:v3.2.7/argoproj/argocd/Dockerfile (deb)
- quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3//usr/local/bin/argocd (gomodules)
- quay.io/argoproj/argocd:v3.2.7//usr/local/bin/kustomize (gomodules)
- quay.io/argoproj/argocd:v3.2.7/helm/v3//usr/local/bin/helm (gomodules)
- quay.io/argoproj/argocd:v3.2.7/git-lfs/git-lfs//usr/bin/git-lfs (gomodules)

11 known vulnerabilities
12 vulnerable dependency paths
2322 dependencies

## Untrusted Search Path

high severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: go.opentelemetry.io/otel/sdk/resource
- Introduced through: github.com/argoproj/argo-cd/v3@* and go.opentelemetry.io/otel/sdk/resource@v1.38.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › go.opentelemetry.io/otel/sdk/resource@v1.38.0

## Overview

Affected versions of this package are vulnerable to Untrusted Search Path in resource detection code which executes `ioreg`, when the `PATH` environment variable is modified to include a malicious executable. An attacker can execute arbitrary code within the context of the application by placing a malicious binary earlier in the search path.

Note: This vulnerability is only exploitable on MacOS/Darwin systems.

## Remediation

Upgrade `go.opentelemetry.io/otel/sdk/resource` to version 1.40.0 or higher.

## References

- GitHub Commit

More about this vulnerability

## Inefficient Algorithmic Complexity

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.2.7/helm/v3 › /usr/local/bin/helm
- Package Manager: golang
- Vulnerable module: golang.org/x/net/html
- Introduced through: helm.sh/helm/v3@* and golang.org/x/net/html@v0.40.0

### Detailed paths

- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/html@v0.40.0

## Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Inefficient Algorithmic Complexity via the `html.Parse` function due to quadratic parsing complexity when processing certain inputs, which can lead to denial of service (DoS) if an attacker provides specially crafted HTML content.

## Remediation

Upgrade `golang.org/x/net/html` to version 0.45.0 or higher.

## References

- GitHub Issue
- Go Advisory
- Go Commit
- Google Groups Forum

More about this vulnerability

## Infinite loop

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.2.7/helm/v3 › /usr/local/bin/helm
- Package Manager: golang
- Vulnerable module: golang.org/x/net/html
- Introduced through: helm.sh/helm/v3@* and golang.org/x/net/html@v0.40.0

### Detailed paths

- Introduced through: helm.sh/helm/v3@* › golang.org/x/net/html@v0.40.0

## Overview

golang.org/x/net/html is a package that implements an HTML5-compliant tokenizer and parser.

Affected versions of this package are vulnerable to Infinite loop via the `html.Parse` function. An attacker can cause resource exhaustion and disrupt service availability by submitting specially crafted HTML input that triggers an infinite parsing loop.

## Remediation

Upgrade `golang.org/x/net/html` to version 0.45.0 or higher.

## References

- GitHub Issue
- Go Advisory
- Go Commit
- Google Groups Forum

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/r3labs/diff/v3
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/r3labs/diff/v3@v3.0.2

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/r3labs/diff/v3@v3.0.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/hashicorp/go-version
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/go-version@v1.7.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/go-version@v1.7.0

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/hashicorp/go-retryablehttp
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/go-retryablehttp@v0.7.8

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/go-retryablehttp@v0.7.8

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.2.7/helm/v3 › /usr/local/bin/helm
- Package Manager: golang
- Module: github.com/hashicorp/go-multierror
- Introduced through: helm.sh/helm/v3@* and github.com/hashicorp/go-multierror@v1.1.1

### Detailed paths

- Introduced through: helm.sh/helm/v3@* › github.com/hashicorp/go-multierror@v1.1.1

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/hashicorp/go-cleanhttp
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/hashicorp/go-cleanhttp@v0.5.2

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/hashicorp/go-cleanhttp@v0.5.2

MPL-2.0 license

More about this vulnerability

## MPL-2.0 license

medium severity

- Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Module: github.com/gosimple/slug
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/gosimple/slug@v1.15.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/gosimple/slug@v1.15.0

MPL-2.0 license

More about this vulnerability

## Improper Validation of Integrity Check Value

medium severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argo-cd/v3 › /usr/local/bin/argocd
- Package Manager: golang
- Vulnerable module: github.com/go-git/go-git/v5/storage/filesystem
- Introduced through: github.com/argoproj/argo-cd/v3@* and github.com/go-git/go-git/v5/storage/filesystem@v5.14.0

### Detailed paths

- Introduced through: github.com/argoproj/argo-cd/v3@* › github.com/go-git/go-git/v5/storage/filesystem@v5.14.0

## Overview

Affected versions of this package are vulnerable to Improper Validation of Integrity Check Value for `.idx` and `.pack` files. An attacker can cause the application to consume corrupted files, leading to unexpected errors, due to checksums not being checked in the `loadIdxFile()` function.

## Workaround

This vulnerability can be mitigated by running 'git fsck' from the git CLI to check for data corruption on a given repository.

## Remediation

Upgrade `github.com/go-git/go-git/v5/storage/filesystem` to version 5.16.5 or higher.

## References

- GitHub Commit
- GitHub Release

More about this vulnerability

## Allocation of Resources Without Limits or Throttling

low severity
Exploit: Not Defined

- Manifest file: quay.io/argoproj/argocd:v3.2.7/argoproj/argocd › Dockerfile
- Package Manager: ubuntu:25.04
- Vulnerable module: glibc/libc-bin
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.2.7 and glibc/libc-bin@2.41-6ubuntu1.2

### Detailed paths

- Introduced through: docker-image|quay.io/argoproj/argocd@v3.2.7 › glibc/libc-bin@2.41-6ubuntu1.2
- Introduced through: docker-image|quay.io/argoproj/argocd@v3.2.7 › glibc/libc6@2.41-6ubuntu1.2

## NVD Description

Note: Versions mentioned in the description apply only to the upstream `glibc` package and not the `glibc` package as distributed by `Ubuntu`. See `How to fix?` for `Ubuntu:25.04` relevant fixed versions and status.

sha256crypt and sha512crypt through 0.6 allow attackers to cause a denial of service (CPU consumption) because the algorithm's runtime is proportional to the square of the length of the password.

## Remediation

There is no fixed version for `Ubuntu:25.04` `glibc`.

## References

- http://people.ubuntu.com/~ubuntu-security/cve/CVE-2016-20013
- https://akkadia.org/drepper/SHA-crypt.txt
- https://pthree.org/2018/05/23/do-not-use-sha256crypt-sha512crypt-theyre-dangerous/
- https://twitter.com/solardiz/status/795601240151457793

More about this vulnerability