Argo CD is susceptible to malicious API requests that can lead to a denial of service, crashing the API server and disrupting service for legitimate users. Specifically, the `/api/webhook` endpoint is vulnerable when the `webhook.gogs.secret` is not configured. In this scenario, receiving a Gogs push event with a missing or null `commits[].repo` JSON field causes the `argocd-server` process to crash. The `affectedRevisionInfo` function lacks proper data structure validation for webhook event types, allowing an attacker to exploit this by sending crafted data. The vulnerability resides in the `Handler` function, which parses webhook type messages based on the `header` and `body` parameters. The `Parse` function unmarshals JSON-type messages without strict validation. An attacker can repeatedly send unauthenticated requests to the `/api/webhook` endpoint to cause a denial of service.