CVE-2025-32386

Published: Apr 9, 2025

Modified: Apr 10, 2025

PUBLISHED

CVSS v3.1

6.5

MEDIUM

Description

Helm is a tool for managing Charts. A chart archive file can be crafted in a manner where it expands to be significantly larger uncompressed than compressed (e.g., >800x difference). When Helm loads this specially crafted chart, memory can be exhausted causing the application to terminate. This issue has been resolved in Helm v3.17.3.

Vendor	Product	Versions
helm	helm	affected `< 3.17.3`

Weaknesses (CWE)

CWE-789

CWE-770

CVSS v3.1 Details

CVSS v3.1 Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

References

https://github.com/helm/helm/security/advisories/GHSA-4hfp-h4cw-hj8p

x_refsource_CONFIRM

https://github.com/helm/helm/commit/d8ca55fc669645c10c0681d49723f4bb8c0b1ce7

x_refsource_MISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Start Training

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.

Scan Now

CVE-2025-32386

Description

Affected Products

Weaknesses (CWE)

CVSS v3.1 Details

References