CLEANSTART-2026-ND19782: net/url package does not set a limit on the number of query parameters in a query

Q: What can an unauthenticated attacker do?

An attacker can remotely send a query containing an excessive number of parameters, which can exhaust resources and cause a denial of service. No authentication or user interaction is required.

Q: Are confidentiality or integrity affected?

The available impact data identifies availability as affected; it does not identify confidentiality or integrity impact.

Q: How can I tell whether an exposed deployment may be affected?

Deployments using the cleanstart/argo-workflows package are identified as affected by this advisory. The provided data does not include affected or fixed version ranges, so version-specific status cannot be determined from it.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. The net/url package does not set a limit on the number of query parameters in a query.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-61726

Frequently Asked Questions

What can an unauthenticated attacker do?

An attacker can remotely send a query containing an excessive number of parameters, which can exhaust resources and cause a denial of service. No authentication or user interaction is required.

Are confidentiality or integrity affected?

The available impact data identifies availability as affected; it does not identify confidentiality or integrity impact.

How can I tell whether an exposed deployment may be affected?

Deployments using the cleanstart/argo-workflows package are identified as affected by this advisory. The provided data does not include affected or fixed version ranges, so version-specific status cannot be determined from it.

CLEANSTART-2026-ND19782: net/url package does not set a limit on the number of query parameters in a query

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What can an unauthenticated attacker do?

Are confidentiality or integrity affected?

How can I tell whether an exposed deployment may be affected?

Company

Resources

Contact

Frequently Asked Questions

What can an unauthenticated attacker do?

Are confidentiality or integrity affected?

How can I tell whether an exposed deployment may be affected?