Security update for helm

This update for helm fixes the following issues: Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: check...

SUSE-SU-2025:20278-1 Security update for helm

This update for helm fixes the following issues: - Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates - Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: chec...

Security update for helm

This update for helm fixes the following issues: Update to version 3.17.2 bsc1238688, CVE-2025-22870: Updating to 0.37.0 for x/net builddeps: bump the k8s-io group with 7 updates Update to version 3.17.1: merge null child chart objects builddeps: bump the k8s-io group with 7 updates fix: check...

Denial Of Service (DoS)

helm.sh/helm/v3 is vulnerable to Denial Of Service DoS. The vulnerability is due to memory exhaustion due to specially crafted chart archives that decompress to a size significantly larger than their compressed form...

AZL-60565 CVE-2025-22872 affecting package helm for versions less than 3.14.2-6

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

AZL-60572 CVE-2025-22872 affecting package helm for versions less than 3.15.2-3

The tokenizer incorrectly interprets tags with unquoted attribute values that end with a solidus character / as self-closing. When directly using Tokenizer, this can result in such tags incorrectly being marked as self-closing, and when using the Parse functions, this can result in content...

Security update for Multi-Linux Manager 5.0: Server, Proxy and Retail Server

Description: This update fixes the following issues: proxy-helm: Version 5.0.12: Image rebuilt to the newest version with updated dependencies proxy-httpd-image: Version 5.0.10: Fixed wrong IP address set on susemanager-tftpsync-recv.conf Image rebuilt to the newest version with updated...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: helm-push, eksctl, cilium-cli, kubescape, pluto, k8ssandra-client, rancher-helm, chart-testing, flux-source-controller, flux-helm-controller, chartmuseum, zarf, k9s, flux, zot, cluster-api-helm-controller, helm-operator, kots, helm-docs, cert-manager-cmctl, trivy,...

GHSA-4HFP-H4CW-HJ8P vulnerabilities

Vulnerabilities for packages: helm-push, eksctl, cilium-cli, kubescape, pluto, k8ssandra-client, rancher-helm, chart-testing, flux-source-controller, flux-helm-controller, chartmuseum, zarf, k9s, flux, zot, cluster-api-helm-controller, helm-operator, kots, helm-docs, cert-manager-cmctl, trivy,...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: helm-push, eksctl, cilium-cli, kubescape, pluto, k8ssandra-client, rancher-helm, chart-testing, flux-source-controller, flux-helm-controller, chartmuseum, zarf, k9s, flux, zot, cluster-api-helm-controller, helm-operator, kots, helm-docs, cert-manager-cmctl, trivy,...

GHSA-5XQW-8HWV-WG92 vulnerabilities

Vulnerabilities for packages: helm-push, eksctl, cilium-cli, kubescape, pluto, k8ssandra-client, rancher-helm, chart-testing, flux-source-controller, flux-helm-controller, chartmuseum, zarf, k9s, flux, zot, cluster-api-helm-controller, helm-operator, kots, helm-docs, cert-manager-cmctl, trivy,...

CVE-2025-32387 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, pluto, kots, chart-testing-fips, chartmuseum-fips, helm-push, consul-k8s, rancher-helm, k8ssandra-client, cert-manager-cmctl, cluster-api-helm-controller, trivy, kuma, cert-manager-cmctl-fips, zarf, tw, flux-helm-controller-fips, flux-fip...

CVE-2025-32386 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, pluto, kots, chart-testing-fips, chartmuseum-fips, helm-push, consul-k8s, rancher-helm, k8ssandra-client, cert-manager-cmctl, cluster-api-helm-controller, trivy, kuma, cert-manager-cmctl-fips, zarf, tw, flux-helm-controller-fips, flux-fip...

GHSA-4HFP-H4CW-HJ8P vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, pluto, kots, chart-testing-fips, chartmuseum-fips, helm-push, consul-k8s, rancher-helm, k8ssandra-client, cert-manager-cmctl, cluster-api-helm-controller, trivy, kuma, cert-manager-cmctl-fips, zarf, tw, flux-helm-controller-fips, flux-fip...

GHSA-5XQW-8HWV-WG92 vulnerabilities

Vulnerabilities for packages: flux-source-controller-fips, pluto, kots, chart-testing-fips, chartmuseum-fips, helm-push, consul-k8s, rancher-helm, k8ssandra-client, cert-manager-cmctl, cluster-api-helm-controller, trivy, kuma, cert-manager-cmctl-fips, zarf, tw, flux-helm-controller-fips, flux-fip...

BIT-HELM-2025-32387 Helm Allows A Specially Crafted JSON Schema To Cause A Stack Overflow

Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3...

BIT-HELM-2025-32386 Helm Allows A Specially Crafted Chart Archive To Cause Out Of Memory Termination

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

CVE-2024-52282 Rancher Helm Applications may have sensitive values leaked

A Exposure of Sensitive Information to an Unauthorized Actor vulnerability in SUSE rancher allowing any users with GET access to the Rancher Manager Apps Catalog to read any sensitive information that are contained within the Apps’ values. Additionally, the same information leaks into auditing lo...

SUSE CVE-2025-32386

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed e.g., 800x difference. When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issu...

SUSE CVE-2025-32387

Helm is a package manager for Charts for Kubernetes. A JSON Schema file within a chart can be crafted with a deeply nested chain of references, leading to parser recursion that can exceed the stack size limit and trigger a stack overflow. This issue has been resolved in Helm v3.17.3...