Use of Uninitialized Resource

Overview Affected versions of this package are vulnerable to Use of Uninitialized Resource via improper validation when parsing Chart.yaml and index.yaml files. An attacker can cause a panic in the application by providing malformed or unexpected YAML content, such as a null maintainer, non-strin...

Helm 安全漏洞

Helm is a Kubernetes package manager from the CNCF Foundation. A security vulnerability exists in Helm versions prior to 3.18.5, which stems from mishandling of JSON Schema files and could lead to memory exhaustion...

CVE-2025-55199 Helm Charts with Specific JSON Schema Values Can Cause Memory Exhaustion

Helm is a package manager for Charts for Kubernetes. Prior to version 3.18.5, it is possible to craft a JSON Schema file in a manner which could cause Helm to use all available memory and have an out of memory OOM termination. This issue has been resolved in Helm 3.18.5. A workaround involves...

CVE-2025-55199

CVE-2025-55199 (Helm) : Pre-3.18.5 Helm can craft a JSON Schema file that may cause Helm to consume all memory and terminate with an OOM. The issue is resolved in Helm 3.18.5. A workaround is to ensure loaded charts do not reference /dev/zero via $ref. Remediation: upgrade to Helm 3.18.5 or later...

PT-2025-33103

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.18.5 Description: Helm is a package manager for Charts for Kubernetes. An improper validation of type error when parsing Chart.yaml and index.yaml files can lead to a panic. This issue impacts YAML validation where a...

PT-2025-33104

Name of the Vulnerable Software and Affected Versions: Helm versions prior to 3.18.5 Description: Helm, a package manager for Kubernetes Charts, is susceptible to a denial-of-service issue. A crafted JSON Schema file can cause Helm to exhaust available memory, leading to an out-of-memory OOM...

GO-2025-3802 Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm

Helm vulnerable to Code Injection through malicious chart.yaml content in helm.sh/helm...

CBL Mariner 2.0 Security Update: helm (CVE-2025-53547)

The version of helm installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-53547 advisory. - Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file alon...

CVE-2025-53547 affecting package helm for versions less than 3.14.2-7

CVE-2025-53547 affecting package helm for versions less than 3.14.2-7. A patched version of the package is available...

CBL Mariner 2.0 Security Update: cert-manager / helm (CVE-2025-32386)

The version of cert-manager / helm installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2025-32386 advisory. - Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it...

CVE-2025-32386 affecting package helm for versions less than 3.14.2-6

CVE-2025-32386 affecting package helm for versions less than 3.14.2-6. A patched version of the package is available...

SUSE CVE-2025-53547

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when...

Local Code Execution (LCE)

helm.sh/helm/v3 is vulnerable to Local Code Execution LCE. The vulnerability is due to insufficient validation and sanitization of the Chart.yaml and Chart.lock files during dependency updates, allowing a maliciously crafted file to trigger local code execution...

Helm vulnerable to Code Injection through malicious chart.yaml content

A Helm contributor discovered that a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Impact Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and thi...

GHSA-557J-XG8C-Q2MM Helm vulnerable to Code Injection through malicious chart.yaml content

A Helm contributor discovered that a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Impact Fields in a Chart.yaml file, that are carried over to a Chart.lock file when dependencies are updated and thi...

CVE-2025-53547

Helm is a package manager for Charts for Kubernetes. Prior to 3.18.4, a specially crafted Chart.yaml file along with a specially linked Chart.lock file can lead to local code execution when dependencies are updated. Fields in a Chart.yaml file, that are carried over to a Chart.lock file when...

SUSE SLES15: helm / helm-bash-completion / helm-fish-completion / etc (SUSE-SU-2025:02121-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2025:02121-1 advisory. Update to version 3.18.3: builddeps: bump golang.org/x/crypto from 0.38.0 to 0.39.0 6838ebc dependabotbot fix: user username...

TencentOS Server 4: helm (TSSA-2024:0616)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2024:0616 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

CVE-2019-18658

In Helm 2.x before 2.15.2, commands that deal with loading a chart as a directory or packaging a chart provide an opportunity for a maliciously designed chart to include sensitive content such as /etc/passwd, or to execute a denial of service DoS via a special file such as /dev/urandom, via...

ROS-20250430-16

The package manager vulnerability for Kubernetes Helm is related to the creation of a diagram file in such a way, that it expands and becomes much larger in uncompressed form. Exploitation of the vulnerability could Allow an attacker acting remotely to cause a denial of service A package manager...