OPENSUSE-SU-2026:21983-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

SUSE-SU-2026:23973-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

SUSE-SU-2026:23984-1 Security update for helm

This update for helm fixes the following issues: - CVE-2026-33814: golang.org/x/net/http2: infinite loop in HTTP/2 transport when given bad SETTINGSMAXFRAMESIZE bsc1265758. - CVE-2026-35204: github.com/helm/helm: helm.sh/helm/v4: Helm: Arbitrary file write via specially crafted plugin bsc1261939....

CVE-2026-35204

CVE-2026-35204 Este repositorio representa una PoC para un CVE-2026-35204 Descripción "Helm es un gestor de paquetes para Charts de Kubernetes. Desde 4.0.0 hasta 4.1.3, un plugin de Helm especialmente diseñado, al ser instalado o actualizado, provocará que Helm escriba el contenido del plugin en...

Important: Red Hat Security Advisory: Helm CLI for Red Hat OpenShift v4.3.0 release

General availability release of Helm CLI for Red Hat OpenShift v4.3.0. Helm is the package manager for Kubernetes, used to define, install, and upgrade applications as reusable charts. This release delivers the Helm CLI for Red Hat OpenShift v4.3.0 binaries built and distributed by Red Hat...

helm-4.3.0-3.1 on GA media (moderate)

helm-4.3.0-3.1 on GA media Announcement ID: openSUSE-SU-2026:11875-1 Rating: moderate Cross-References: CVE-2026-81871 CVE-2026-81872 CVSS scores: CVE-2026-81871 SUSE : 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-81872 SUSE : 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Affected...

CVE-2026-93537

SUSE Rancher Fleet is vulnerable to a path traversal vulnerability in the Helm valuesFiles component. An attacker with permission to supply bundle content to a GitRepo resource (e.g., via Git push access) can force the system to read arbitrary files from the filesystem of the bundle-processing en...

CVE-2026-53493 vulnerabilities

Vulnerabilities for packages: helm-push, neuvector-scanner, tigera-operator, wolfictl, rancher, spegel, dagger, skaffold, headlamp, scorecard, steampipe, grype, zot, helm-set-status, k8sgpt, gatekeeper, trivy-operator, docker-cli-buildx, k9s, nerdctl, manifest-tool, k3s, kubevela, kargo,...

helm-4.3.0-2.1 on GA media (moderate)

helm-4.3.0-2.1 on GA media Announcement ID: openSUSE-SU-2026:11848-1 Rating: moderate Cross-References: CVE-2026-85732 CVSS scores: CVE-2026-85732 SUSE : 4.7 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N CVE-2026-85732 SUSE : 5.3 CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N...

CLEANSTART-2026-YE46626 Previously, a channel registered in the mux's chanList is not usable until it is established

Security vulnerability affects the helm-operator package. Previously, a channel registered in the mux's chanList is not usable until it is established...

CLEANSTART-2026-LY26617 Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection

Security vulnerability affects the helm-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

PT-2026-105237

Security vulnerability affects the helm-operator package. Previously, after a channel has been established, a malicious peer could send crafted messages that would deadlock the entire connection...

PT-2026-105256

Security vulnerability affects the helm-operator package. Previously, a channel registered in the mux's chanList is not usable until it is established...

OPENSUSE-SU-2026:11875-1 helm-4.3.0-3.1 on GA media

These are all security issues fixed in the helm-4.3.0-3.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2026:11848-1 helm-4.3.0-2.1 on GA media

These are all security issues fixed in the helm-4.3.0-2.1 package on the GA media of openSUSE Tumbleweed...

SUSE-SU-2026:21434-1 Security update for helm

This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory OOM termination bsc1248093. - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output...

SUSE-SU-2026:21461-1 Security update for helm

This update for helm fixes the following issues: Update to version 3.20.2. Security issued fixed: - CVE-2025-55199: specially crafted JSON Schema can lead to out of memory OOM termination bsc1248093. - CVE-2026-35206: specially crafted Chart will have contents extracted to immediate output...

GHSA-M37J-52J7-PJW7 vulnerabilities

Vulnerabilities for packages: opentofu, helm-push, rancher-helm, tigera-operator, xeol, helm-set-status, k8sgpt, k9s, kyverno-notation-aws, helm-mapkubeapis, kube-arangodb, manifest-tool, cluster-api-helm-controller, gitness, flux-helm-controller, kargo, maru, cert-manager-cmctl...

OPENSUSE-SU-2026:11820-1 helm-4.3.0-1.1 on GA media

These are all security issues fixed in the helm-4.3.0-1.1 package on the GA media of openSUSE Tumbleweed...

CLEANSTART-2026-NZ83550 Security fix for CVE-2025-58186 applied in: apache-nifi 2.10.0-r4, argo-cd 2.14.20-r0, argo-cd-fips 2.13.9-r3, argo-cd-fips 2.14.20-r0, argo-cd-fips 3.1.9-r0, cert-manager-cmctl-fips 2.4.0-r1, cert-manager-fips 1.18.2-r0, cert-manager-fips 1.19.1-r0, cert-manager-webhook-pdns-fips 2.2.0-r0, chartmuseum-fips 0.15.0-r4, chartmuseum-fips 0.16.3-r3, cni-plugin-flannel 1.6.0-r0, cosign 2.4.3-r0, cosign 2.5.3-r0, dex-fips 2.41.1-r4, dex-fips 2.42.1-r4, dex-fips 2.43.1-r4, druid-exporter-fips 0.11-r2, eck-operator-fips 3.2.0-r0, external-dns-fips 0.20.0-r0, flux-notification-controller-fips 1.5.0-r0, git-lfs-fips 3.7.0-r0, go-discover-fips 0_git20250325-r0, go-fips-1.24 1.24.9-r0, go-fips-1.25 1.25.1-r0, harbor-registry 3.0.0.1-r2, harbor-registry-fips 3.0.0-r1, helm 3.19.0-r0, helm-fips 3.19.0-r0, helm-operator 1.41.1-r0, k8ssandra-client-fips 0.7.0-r2, k8ssandra-client-fips 0.7.0-r4, k8ssandra-operator 1.26.0-r0, kube-rbac-proxy-fips 0.19.1-r1, kube-state-metrics 2.16.0-r3, kubernetes 1.34.1-r0, kubernetes-csi-node-driver-registrar 2.13.0-r0, kured 1.20.0-r0, kustomize-fips 5.7.1-r0, kyverno 1.15.2-r0, logstash-exporter 1.9.1-r0, metallb 0.14.9-r0, metallb 0.15.2-r0, minio-operator 7.1.1-r0, modelmesh-runtime-adapter 0.12.0-r0, modelmesh-runtime-adapter 0.12.0-r1, nvidia-container-toolkit 1.19.0-r0, opensearch-k8s-operator-fips 2.5.1-r1, opensearch-k8s-operator-fips 2.6.1-r7, opensearch-k8s-operator-fips 2.7.0-r8, prometheus-node-exporter 1.8.0-r3, runc 1.1.14-r0, spark-operator 2.2.1-r0, stakater-reloader 1.4.8-r0, step 0.28.7-r1, step-cli 0.28.7-r1, step-issuer 0.9.9-r1, step-issuer-fips 0.9.11-r1, step-issuer-fips 0.9.9-r1, vault-k8s 1.7.0-r0, velero 1.17.0-r0, velero-plugin-for-aws 1.13.0-r0, velero-plugin-for-csi 0.7.1-r0, wave 0.10.0-r0

CVE-2025-58186 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...