CVSS: 8.5EPSS: 0%CPEs: 1EXPL: 1CVE-2025-53547 – Helm Chart Dependency Updating With Malicious Chart.yaml Content And Symlink Can Lead To Code Execution
https://notcve.org/view.php?id=CVE-2025-53547
08 Jul 2025 — Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and this file is written, can be crafted in a way that can cause execution if that same content were in a file that is executed (e.g., a bash.rc file or shell script). If the Chart.lock file is ... • https://github.com/DVKunion/CVE-2025-53547-POC • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-32386 – Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination
https://notcve.org/view.php?id=CVE-2025-32386
09 Apr 2025 — Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issue has been resolved in Helm v3.17.3. This update for helm-mirror fixes the following issues. • https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7 • CWE-770: Allocation of Resources Without Limits or Throttling CWE-789: Memory Allocation with Excessive Size Value •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2025-32387 – Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow
https://notcve.org/view.php?id=CVE-2025-32387
09 Apr 2025 — Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3. This update for helm-mirror fixes the following issues. Fixed denial of service due to memory exhaustion after loading a specially crafter chart. • https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7 • CWE-121: Stack-based Buffer Overflow CWE-674: Uncontrolled Recursion •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26147 – Helm's Missing YAML Content Leads To Panic
https://notcve.org/view.php?id=CVE-2024-26147
21 Feb 2024 — Helm is a package manager for Charts for Kubernetes. Versions prior to 3.14.2 contain an uninitialized variable vulnerability when Helm parses index and plugin yaml files missing expected content. When either an `index.yaml` file or a plugins `plugin.yaml` file were missing all metadata a panic would occur in Helm. In the Helm SDK, this is found when using the `LoadIndexFile` or `DownloadIndexFile` functions in the `repo` package or the `LoadDir` function in the `plugin` package. For the Helm client this im... • https://github.com/helm/helm/commit/bb4cc9125503a923afb7988f3eb478722a8580af • CWE-457: Use of Uninitialized Variable •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-25620 – Dependency management path traversal in helm
https://notcve.org/view.php?id=CVE-2024-25620
14 Feb 2024 — Helm is a tool for managing Charts. Charts are packages of pre-configured Kubernetes resources. When either the Helm client or SDK is used to save a chart whose name within the `Chart.yaml` file includes a relative path change, the chart would be saved outside its expected directory based on the changes in the relative path. The validation and linting did not detect the path changes in the name. This issue has been resolved in Helm v3.14.1. • https://github.com/helm/helm/commit/0d0f91d1ce277b2c8766cdc4c7aa04dbafbf2503 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 1CVE-2023-25165 – getHostByName Function Information Disclosure
https://notcve.org/view.php?id=CVE-2023-25165
08 Feb 2023 — Helm is a tool that streamlines installing and managing Kubernetes applications.`getHostByName` is a Helm template function introduced in Helm v3. The function is able to accept a hostname and return an IP address for that hostname. To get the IP address the function performs a DNS lookup. The DNS lookup happens when used with `helm install|upgrade|template` or when the Helm SDK is used to render a chart. • https://github.com/helm/helm/commit/5abcf74227bfe8e5a3dbf105fe62e7b12deb58d2 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23526 – Helm contains Denial of service through schema file
https://notcve.org/view.php?id=CVE-2022-23526
15 Dec 2022 — Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the_chartutil_ package that can cause a segmentation violation. The _chartutil_ package contains a parser that loads a JSON Schema validation file. For example, the Helm client when rendering a chart will validate its values with the schema file. The _chartutil_ package parses the schema file and loads it into structures Go can work with. • https://github.com/helm/helm/commit/bafafa8bb1b571b61d7a9528da8d40c307dade3d • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23525 – Helm vulnerable to Denial of service via NULL Pointer Dereference
https://notcve.org/view.php?id=CVE-2022-23525
15 Dec 2022 — Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to NULL Pointer Dereference in the _repo_package. The _repo_ package contains a handler that processes the index file of a repository. For example, the Helm client adds references to chart repositories where charts are managed. The _repo_ package parses the index file of the repository and loads it into structures Go can work with. • https://github.com/helm/helm/commit/638ebffbc2e445156f3978f02fd83d9af1e56f5b • CWE-476: NULL Pointer Dereference •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-23524 – Helm vulnerable to Denial of service through string value parsing
https://notcve.org/view.php?id=CVE-2022-23524
15 Dec 2022 — Helm is a tool for managing Charts, pre-configured Kubernetes resources. Versions prior to 3.10.3 are subject to Uncontrolled Resource Consumption, resulting in Denial of Service. Input to functions in the _strvals_ package can cause a stack overflow. In Go, a stack overflow cannot be recovered from. Applications that use functions from the _strvals_ package in the Helm SDK can have a Denial of Service attack when they use this package and it panics. • https://github.com/helm/helm/security/advisories/GHSA-6rx9-889q-vv2r • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •
CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2022-36049 – Flux2 Helm Controller denial of service
https://notcve.org/view.php?id=CVE-2022-36049
07 Sep 2022 — Flux2 is a tool for keeping Kubernetes clusters in sync with sources of configuration, and Flux's helm-controller is a Kubernetes operator that allows one to declaratively manage Helm chart releases. Helm controller is tightly integrated with the Helm SDK. A vulnerability found in the Helm SDK that affects flux2 v0.0.17 until v0.32.0 and helm-controller v0.0.4 until v0.23.0 allows for specific data inputs to cause high memory consumption. In some platforms, this could cause the controller to panic and stop ... • https://bugs.chromium.org/p/oss-fuzz/issues/detail?id=44996 • CWE-400: Uncontrolled Resource Consumption CWE-770: Allocation of Resources Without Limits or Throttling •