CLEANSTART-2026-SV05372: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Q: Who is exposed to this issue?

Deployments using the cleanstart/argo-workflows package may be exposed where the package parses email addresses according to RFC 5322.

Q: What does an attacker need to exploit it?

The reported severity vector indicates exploitation is network-accessible, requires low attack complexity, and does not require privileges or user interaction. The attacker would need to supply a pathological email-address input that reaches the affected parser.

Q: What is the expected impact of successful exploitation?

Successful exploitation can cause a denial of service through consumePhrase. The provided vector indicates availability impact only, with no reported confidentiality or integrity impact.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-42499

Frequently Asked Questions

Who is exposed to this issue?

Deployments using the cleanstart/argo-workflows package may be exposed where the package parses email addresses according to RFC 5322.

What does an attacker need to exploit it?

The reported severity vector indicates exploitation is network-accessible, requires low attack complexity, and does not require privileges or user interaction. The attacker would need to supply a pathological email-address input that reaches the affected parser.

What is the expected impact of successful exploitation?

Successful exploitation can cause a denial of service through consumePhrase. The provided vector indicates availability impact only, with no reported confidentiality or integrity impact.

CLEANSTART-2026-SV05372: Pathological inputs could cause DoS through consumePhrase when parsing an email address according to RFC 5322

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the expected impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

What is the expected impact of successful exploitation?