CLEANSTART-2026-ZR72017: processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

Q: Who can exploit this issue?

The vector is network-accessible and requires no privileges or user interaction. An attacker would need to submit specially crafted invalid input to a reachable argo-workflows parsing path.

Q: What is the likely impact of exploitation?

The reported impact is availability loss. Parsing certain invalid inputs can consume disproportionately increasing processing time as input size grows, potentially degrading or exhausting service capacity.

Q: How can I tell whether my deployment may be exposed?

Assess whether argo-workflows is reachable over the network and accepts inputs that are parsed by the affected component. The supplied data does not identify affected versions, fixed versions, or a specific configuration condition.

Published Nov 11, 2026

Updated

Security vulnerability affects the argo-workflows package. The processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input.

Affected Software

1 affected componentFixes available

cleanstart/argo-workflows<4.1.6-r1

4.1.6-r1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/argo-workflows to a version that resolves this vulnerability.
Fixed in 4.1.6-r1

Event History

Nov 11, 2026

Advisory Published

via OSV·12:38 AM

Data Sourced

via OSV·12:38 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-61723

Frequently Asked Questions

Who can exploit this issue?

The vector is network-accessible and requires no privileges or user interaction. An attacker would need to submit specially crafted invalid input to a reachable argo-workflows parsing path.

What is the likely impact of exploitation?

The reported impact is availability loss. Parsing certain invalid inputs can consume disproportionately increasing processing time as input size grows, potentially degrading or exhausting service capacity.

How can I tell whether my deployment may be exposed?

Assess whether argo-workflows is reachable over the network and accepts inputs that are parsed by the affected component. The supplied data does not identify affected versions, fixed versions, or a specific configuration condition.

CLEANSTART-2026-ZR72017: processing time for parsing some invalid inputs scales non-linearly with respect to the size of the input

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact of exploitation?

How can I tell whether my deployment may be exposed?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the likely impact of exploitation?

How can I tell whether my deployment may be exposed?